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ENSURING THE SAFETY OF HUMAN 
SPACEFLIGHT 


WEDNESDAY, DECEMBER 2, 2009 

House of Representatives, 
Subcommittee on Space and Aeronautics, 

Committee on Science and Technology, 

Washington, DC. 

The Subcommittee met, pursuant to call, at 10:00 a.m., in Room 
2318 of the Rayburn House Office Building, Hon. Gabrielle Giffords 
[Chairwoman of the Subcommittee] presiding. 
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HEAHING CHARTER 

COMMITTEE ON SCIENCE AND TECHNOLOGY 
SUBCOMMITTEE ON SPACE AND AERONAUTICS 
U.S. HOUSE OF REPRESENTATIVES 

Ensuring the Safety of 
Human Space Flight 

DECEMBER 2, 2009 
10 A.M.-NOON 

2318 RAYBURN HOUSE OFFICE BUILDING 


I. Purpose 

On December 2, 2009 the Subcommittee on Space and Aeronautics will hold a 
hearing focused on issues related to ensuring the safety of future human space 
flight in government and non-government space transportation systems. The hear- 
ing will examine (1) the steps needed to establish confidence in a space transpor- 
tation system’s ability to transport U.S. and partner astronauts to low Earth orbit 
and return them to Earth in a safe manner, (2) the issues associated with imple- 
menting safety standards and establishing processes for certifying that a space 
transportation vehicle is safe for human transport, and (3) the roles that training 
and experience play in enhancing the safety of human space missions. 

II. Scheduled Witnesses: 

Mr. Bryan D. O’Connor 

Chief of Safety and Mission Assurance 
National Aeronautics and Space Administration 

Mr. Jeff Hanley 

Program Manager 

Constellation Program 

Exploration Systems Mission Directorate 

National Aeronautics and Space Administration 

Mr. John C. Marshall 

Council Member 

Aerospace Safety Advisory Panel 

National Aeronautics and Space Administration 

Mr. Bretton Alexander 

President 

Commercial Spaceflight Federation 

Dr. Joseph R. Fragola 

Vice President 
Valador, Inc. 

Lt. Gen. Thomas P. Stafford, USAF (ret.) 

III. Overview 

The Review of U.S. Human Space Flight Plans Committee, also known as the Au- 
gustine committee, recently issued its final report. The committee was tasked to 
“conduct an independent review of ongoing U.S. human space flight plans and pro- 
grams, as well as alternatives, to ensure the Nation is pursuing the best trajectory 
for the future of human space flight — one that is safe, innovative, affordUible, and 
sustainable. The review eommittee should aim to identify and characterize a range 
of options that spans the reasonable possibilities for eontinuation of U.S. human 
space flight activities beyond retirement of the Space Shuttle.” 

As directed, the committee’s final report offered a number of options to the presi- 
dent for the conduct of future space exploration, ranging from continuing with the 
Constellation Program of Record (with slight modifications) to pursuing a “flexible 
path” with alternative launch vehicles, including modified Evolved Expendable 
Launch Vehicles (EELV) currently used primarily by the Department of Defense to 
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transport military payloads. Several of the committee’s options included the use of 
as-yet-to-be-developed commercial services to provide future crew transportation to 
and from the International Space Station (ISS) following retirement of the Space 
Shuttle. While the committee stated that it recognized both the risks and opportuni- 
ties presented by commercial crew services, it believed such services could be avail- 
able by 2016. Specifically, the report stated: 

“The United States needs a way to launch astronauts to low-Earth orbit, but it 
does not necessarily have to be provided by the government. As we move from 
the eomplex, reusable Shuttle back to a simpler, smaller capsule, it is an appro- 
priate time to consider turning this transport service over to the commereial sec- 
tor. This approach is not without technical and programmatic risks, but it cre- 
ates the possibility of lower operating easts for the system and potentially aceeler- 
ates the availability of U.S. access to low-Earth orbit by about a year, to 2016. 
The Committee suggests establishing a new competition for this service, in which 
both large and small companies could participate.” 

Using commercial providers for space transportation is not a new idea. Congress 
has encouraged NASA to use commercial transportation services when appropriate 
as part of its space exploration strategy. Support for the commercial space industry 
was affirmed in P.L. 110-422, the National Aeronautics and Space Administration 
Authorization Act of 2008. Along with that support however was a requirement for 
commercial services’ prior conformance with NASA’s safety requirements. Specifi- 
cally, regarding crew transportation, the Act stated in Sec. 902 that the National 
Aeronautics and Space Administration (NASA) shall: 

“make use of United States commercially provided International Space Station 
erew transfer and erew rescue services to the maximum extent practicable, if 
those commercial services have demonstrated the capability to meet NASA-speei- 
fied ascent, entry, and International Spaee Station proximity operations safety 
requirements.” 

Those NASA safety requirements are primarily embodied in NASA Procedural Re- 
quirements (NPR) document NPR 8705. 2B, “Human-Rating Requirements for Space 
Systems” as well as in the ISS Visiting Vehicle requirements that govern proximity 
operations around the ISS. While the NPR requirements ^ply to the development 
and operation of crewed space systems developed by NASA and used to conduct 
NASA human spaceflight missions, the NPR also states that it “may apply to other 
crewed spaee systems when documented in separate requirements or agreements”. 

Progress has been made in the past few years by commercial entities in designing 
and developing cargo launch capabilities which have the potential to access the ISS. 
However, they are not scheduled to demonstrate the capability to transport cargo 
to the ISS as part of NASA’s Commercial Orbital Transportation Services (COTS) 
Demonstration project until the second quarter of Fiscal Year 2010, at the earliest. 
The transporting of NASA astronauts to low Earth orbit and ensuring their safe re- 
entry to Earth is considered to be significantly more challenging than transporting 
cargo to the ISS. 

That is the crux of the issue. Establishing and enforcing safety standards for the 
transport of crew on commercially provided orbital crew transportation services is 
in many ways uncharted territory. Furthermore, a process has yet to be advanced 
by the government on how the “airworthiness” of commercial space flight vehicles 
used to transport government passengers will be “certified”. While the Augustine 
committee’s report projected that commercial crew transportation services could be 
available in 2016, it does not appear that the committee’s projection accounts for 
all of the milestones that must he met prior to the point at which NASA would be 
able to use such services to fly its astronauts to the ISS. Notionally, these include: 
prior Congressional authorization and appropriation of funds for such an activity, 
which could not occur before enactment of the FY 2011 appropriation for NASA at 
the earliest; agreement on human-rating and other safety standards and means for 
verifying compliance, development and implementation of new safety processes, test- 
ing and verification procedures to ensure safety, and potentially a new regulatory 
regime for certification; development of a COTS-like demonstration program open to 
multiple participants and competition/award of Space Act Agreements for the dem- 
onstration program; completion of the development/demonstration program, which 
would need to include a TBD number of demonstration flights, including tests of 
launch escape systems, etc.; subsequent preparation of an RFP for commercial crew 
transportation/ISS crew rescue services; contract competition, negotiation and award 
of contract(s), and potential protest(s) by losing bidder(s) [which unfortunately has 
become a more frequent occurrence in recent Department of Defense (DoD)/NASA 
contract competitions]; manufacturing of the operational flight vehicle systems 
[some of which could potentially be initiated during the development/demonstration 
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phase, assuming the companies would be able to fund those tasks with private cap- 
ital]; TBD number of “certification” flights of the production vehicle system prior to 
NASA agreement to put its astronauts on board; and finally, commencement of ini- 
tial operations to and from the ISS. 

Any mismatch between the timetable asserted in the Augustine committee’s re- 
port and the actual time required to bring commercially provided crew transpor- 
tation services to operational status is relevant because it highlights a potential in- 
ability to meet even a fraction of NASA’s crew transfer needs for the ISS prior to 
the end of even an extended ISS operations period [i.e., an ISS extension to 2020], 
which in turn calls into question the ability of would-be commercial providers to 
identify a credible government market when seeking private capital commitments. 
In the absence of a government commitment to pay for services whether or not they 
are available when needed, would-be commercial providers could face pressures to 
cut costs [or cease to compete], and the government would thus have to be vigilant 
to ensure that safety-related processes and practices were not compromised as a re- 
sult. 

Regardless of the approach to NASA’s human space flight and exploration pro- 
gram that is recommended to Congress by the president, commercial space providers 
may well play an expanding role in transporting cargo to low Earth orbit (LEO) and 
eventually beyond LEO, and potentially transporting crew to and from LEO in the 
future. Consequently, it is prudent to initiate a detailed examination of the steps 
needed to establish confidence in commercial space transportation systems’ capabili- 
ties to transport U.S. and partner astronauts to low Earth orbit and return them 
to Earth safely. 

At the hearing, witnesses will provide a historical perspective on the establish- 
ment of safety requirements in NASA human space flight systems; NASA’s efforts 
to develop human safety standards and requirements; the incorporation of crew 
safety requirements in the design of NASA’s Constellation Program; and the com- 
mercial space transportation companies’ expectations of how NASA’s safety stand- 
ards and requirements would be applied to commercial spacecraft as well as the 
level of governmental insight and oversight over their development activities and 
operations that they would consider appropriate. 

rV. Issues 

The hearing will focus on the following questions and issues: 

• What are the most important safety -related issues that need to be addressed 
in either a government or non-government space transportation system^ 

• What would be the safety implications of terminating the government crew 
transportation system currently under development in favor of relying on as- 
yet-to-be-developed commercially provided crew transportation services^ What 
would the government be able to do, if anything, to ensure that no reduction 
in planned safety levels occurred as a result? 

• What expectations should Congress have regarding the safety standards com- 
mercial providers should meet if their proposed crew transportation and ISS 
crew rescue services were to be chosen by NASA to carry its astronauts to low 
Earth orbit? What would be required to verify compliance with those stand- 
ards? 

• If a policy decision were made to require NASA to rely solely on commercial 
crew transfer services, which would have to meet NASA’s safety requirements 
to be considered for use by NASA astronauts, what impact would that have 
on the ability of emerging space companies to pursue innovation and design 
improvements made possible [as the industry has argued] by the accumulation 
of flight experience gained from commencing revenue operations unconstrained 
by a prior safety certification regime? Would it be in the interest of the emerg- 
ing commercial orbital crew transportation industry to have to be reliant on 
the government as its primary /sole customer at this stage in its development? 

• What lessons learned from the evolution of NASA’s human space flight systems 
should be reflected in the design and operation of future crewed space trans- 
portation systems, whether government or non-government? 

• What role does NASA’s Office of Safety and Mission Assurance play in ensur- 
ing the safety of human space flight at NASA? What initiatives does the office 
have underway to enhance the safety of human space flight at NASA? 

• What is being done to communicate NASA’s safety and human-rating require- 
ments to potential commercial crew space transportation and ISS crew rescue 
services providers? 
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• How and to what extent did safety considerations, especially with respect to 
launch, inform the choices made in NASA’s Exploration Systems Architecture 
Study (ESAS)? 

• How has the Constellation Program incorporated safety and applicable 
human-rating requirements, as well as Astronaut Office input on launch ! entry 
systems safety, into the program’s design, development, and testing activities'^ 

• What has NASA learned so far in executing the Constellation Program that 
can assist in developing a better understanding of the impact of design fea- 
tures, development and testing and manufacturing processes, and operations 
procedures on the safety of crewed space transportation system alternatives? 

• What are the expectations of potential commercial crew transportation services 
providers as to how safety standards and processes will be determined if the 
government decided to use commercial services for the transport of NASA as- 
tronauts to and from low Earth orbit and the ISS? 

• What do potential commercial crew transportation services providers consider 
to be an acceptable safety standard to which potential commercial providers 
must conform if their space transportation systems were to be chosen by NASA 
to carry its astronauts to low Earth orbit and the ISS? Would the same safety 
standard be used for non-NASA commercial human transportation missions? 

• What do potential commercial crew transportation services providers consider 
to be an acceptable level of insight and oversight over their development, test, 
and manufacturing process, their vehicles, and operations if their services are 
used to transport NASA astronauts to and from low Earth orbit and provide 
ISS crew rescue services? 

• What do potential commercial crew transportation services providers consider 
to be an acceptable certification regime that potential commercial services pro- 
viders must comply with to address the government’s regulatory responsibil- 
ities over the safety and “air worthiness” of commercial crew transportation ve- 
hicles prior to their approval for use in revenue-generating flight operations, 
whether for government or non-government customers? 

• What training and familiarization with non-NASA crewed spacecraft and 
launch vehicles would astronauts flying on such non-NASA spacecraft and 
launch vehicles need in order to deal with off-nominal conditions, contingency 
operations and emergencies? 

V. Background 

Relevant Legislation and Hearing on Safety Issues Associated with Commercial 
Space Launches 

NASA Authorization Act of 2005 

P.L. 109-155, the National Aeronautics and Space Administration Authorization 
Act of 2005, directed that an independent presidential commission be established to 
investigate incidents resulting in the loss of a U.S. space vehicle used pursuant to 
a contract with the Federal government or loss of a crew member or passenger in 
such a vehicle. The Act made clear that Congress believed that an accident involv- 
ing astronauts riding on a commercial vehicle would be treated as at least as serious 
a matter as one involving a government vehicle. Specifically, the Act specified: 

“(a) ESTABLISHMENT. — The President shall establish an independent, non- 
partisan Commission within the executive branch to investigate any incident that 
results in the loss of — 

(1) a Space Shuttle; 

(2) the International Space Station or its operational viability; 

(3) any other United States space vehicle carrying humans that is owned by 
the Federal Government or that is being used pursuant to a contract with 
the Federal Government; or 

(4) a crew member or passenger of any space vehicle described in this sub- 
section. 

(b) DEADLINE FOR ESTABLISHMENT. — The President shall establish a Com- 
mission within 7 days after an incident specified in subsection (a).” 

The independent commission would be tasked, to the extent possible, to inves- 
tigate the incident; determine the cause of the incident; identify all contributing fac- 
tors to the cause of the incident; make recommendations for corrective actions; pro- 
viding any additional findings or recommendations deemed by the Commission to 
be important; and prepare a report to Congress, the president, and the public. 
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NASA Authorization Act of 2008 

The Congress affirmed its support for the commercial space industry in P.L. 110- 
422, the National Aeronautics and Space Administration Authorization Act of 2008. 
The Act states in its findings that 

“Commercial activities have substantially contributed to the strength of both the 
United States space program and the national economy, and the development of 
a healthy and robust United States commercial space sector should continue to 
be encouraged.” 

With regards to the potential use of commercially-provided ISS crew transfer and 
crew rescue services, the Act states that NASA may make use of commercial serv- 
ices if those commercial services have demonstrated the capability to meet NASA’s 
safety requirements. Specifically, the Act states: 

“(a) IN GENERAL. — In order to stimulate commercial use of space, help maxi- 
mize the utility and productivity of the International Space Station, and enable 
a commercial means of providing crew transfer and crew rescue services for the 
International Space Station, NASA shall — 

(1) make use of United States commercially provided International Space 
Station crew transfer and crew rescue services to the maximum extent prac- 
ticable, if those commercial services have demonstrated the capability to 
meet NASA-specified ascent, entry, and International Space Station prox- 
imity operations safety requirements; 

(2) limit, to the maximum extent practicable, the use of the Crew Exploration 
Vehicle to missions carrying astronauts beyond low Earth orbit once com- 
mercial crew transfer and crew rescue services that meet safety requirements 
become operational; 

(3) facilitate, to the maximum extent practicable, the transfer of NASA-devel- 
oped technologies to potential United States commercial crew transfer and 
rescue service providers, consistent with United States law; and 

(4) issue a notice of intent, not later than 180 days after the date of enact- 
ment of this Act, to enter into a funded, competitively awarded Space Act 
Agreement with 2 or more commercial entities for a Phase 1 Commercial Or- 
bital Transportation Services crewed vehicle demonstration program.” 

However, with respect to subsection (4) above, the 2008 Act also made clear in 
Sec. 902(b) that: 

“(b) CONGRESSIONAL INTENT. — It is the intent of Congress that funding for 
the program described in subsection (a)(4) shall not come at the expense of full 
funding of the amounts authorized under section 101(3)(A), and for future fiscal 
years, for Orion Crew Exploration Vehicle development. Ares I Crew Launch Ve- 
hicle development, or International Space Station cargo delivery.” 

Government Indemnification for Commercial Space Launch Operations 

In 1988, Congress amended the Commercial Space Launch Act of 1984 to indem- 
nify the commercial space launch industry against successful claims by third par- 
ties. Specifically, the United States agreed, subject to appropriation of funds, to pay 
third party claims against licensees in amounts up to $1.5 billion [in 1989 dollars] 
above the amount of insurance that a licensee carries. The Act’s definition of “third 
party” excludes all government employees, private employees, and contractors in- 
volved directly with the launch of a vehicle. 

The Act requires that private launch companies purchase sufficient liability insur- 
ance. This amount is determined by the Federal Aviation Administration (FAA) on 
a case-by-case basis depending on its calculation of the “maximum probable loss” 
from claims by a third party. This amount is capped at $500 million for coverage 
against suits by private entities. 

Since the majority of commercial launch activity occurs at federal launch ranges, 
the Act also requires any insurance policy a company obtains to also protect the fed- 
eral government, its agencies, personnel, contractors, and subcontractors. The liabil- 
ity insurance section of the Act requires reciprocal waivers of claims between the 
licensee and its contractors, subcontractors, and customers. In effect, the licensee 
and any other organization assisting in the actual launch are prevented from seek- 
ing damages from one another. The indemnification and liability regime was first 
established by Congress as part of the Commercial Space Launch Act Amendments 
of 1988 and has been extended four times since its original enactment. On October 
20, 2009, the U.S. House of Representatives passed H.R. 3819, a bill to extend the 
commercial space transportation indemnification and liability regime, by a voice 
vote. The liability risk-sharing regime extension is set to expire at the end of the 
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year; H.R. 3819 would extend it for three more years. Congress has not yet explicitly 
addressed the issues of indemnification and liability for future commercially pro- 
vided orbital human space flight services. 

Commercial Space Launch Amendments Act of 2004 

The Commercial Space Launch Amendments Act of 2004 put an initial regulatory 
framework in place for commercial human space flight. The intent of the law was 
to support the development of this private sector effort while also protecting the 
safety of uninvolved public on the ground. The law established an “informed con- 
sent” regime for carrying space flight crew and participants (passengers). The Act 
also created a new experimental launch permit for test and development of reusable 
suborbital launch vehicles. The 2004 law called for FAA to “encourage, facilitate, 
and promote the continuous improvement of the safety of launch vehicles designed 
to carry humans.” To allow the industry to grow and innovate, the Act stated that 
“Beginning 8 years after the date of enactment of the Commercial Space Launch 
Amendments Act of 2004, the Secretary may propose regulations” pertaining to crew 
and passengers, further adding that “Any such regulations shall take into consider- 
ation the evolving standards of safety in the commercial space flight industry.” The 
eight year period [which ends in 2012] reflected the view that by then, the commer- 
cial human space flight industry would be “less experimental.” 

As part of the “informed consent” regime, FAA regulations require an operator to 
inform in writing any individual serving as crew that the United States Government 
has not certified the launch vehicle and any reentry vehicle as safe for carrying 
flight crew or space flight participants. Similarly, the operator must inform each 
space flight participant in writing about the risks of the launch and reentry, includ- 
ing the safety record of the launch or reentry vehicle type. The “informed consent” 
rules became effective in December 2006. 

FAA’s subsequent rules call for launch vehicle operators to provide certain safety- 
related information and identify what an operator must do to conduct a licensed 
launch with a human on board. The protocols also include training and general se- 
curity requirements for space flight participants. As part of the new measures, 
launch providers must also establish requirements for crew notification, medical 
qualifications, and training, as well as requirements governing environmental con- 
trol and life-support systems. An operator must also verify the integrated perform- 
ance of a vehicle’s hardware and any software in an operational flight environment 
before carrying a space flight passenger. However, in issuing operator licenses, FAA 
does not certify the launch vehicle as safe as the agency customarily does with air- 
craft. In the latter case, the agency’s Office of Aviation Safety provides initial certifi- 
cation of aircraft and periodically inspects an aircraft and certifies it as safe to fly. 
With regards to spacecraft, FAA can also issue experimental permits for launches 
of reusable vehicles conducted for research and development activities related to 
suborbital flight, for demonstrations of compliance with licensing requirements, or 
for crew training before obtaining a license. 

2003 Joint Hearing on Commercial Human Space Flight 

The Subcommittee and the Senate’s Subcommittee on Science, Technology, and 
Space of the Committee on Commerce, Science and Transportation held a hearing 
entitled Commercial Human Space Flight in July 2003. Among the issues discussed 
at the joint hearing were when revenue launches would begin to happen, “what is 
safe enough”, and whether the government should certify the safety of commercial 
vehicles prior to the commencement of passenger-carrying operations. 

At the 2003 hearing. Senator Sam Brownback asked the witnesses when they 
could take their first commercial paying human customer into space. Mr. Jeff 
Greason, President of XCOR Aerospace said: 

“That depends, in part, on factors that are not entirely in my control, like how 
fast we lock up some of the remaining investment. But if the investment is in 
hand, not sooner than about three years, because we have an extensive test pro- 
gram we have to go through.” 

In response to Senator Brownback’s question, Mr. Elon Musk, the CEO of Space 
Exploration Technologies, said: 

“Well, the task that SpaceX has set for itself is probably an order of magnitude 
greater than sub-orbital flight. We’ve really aimed at orbital flight, really essen- 
tially the job that the Space Shuttle does. That’s a longer road. But I think it’s 
conceivable we could get something done in the 2006 time frame, as well.” 
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With regards to safety, then-Subcommittee Ranking Member Bart Gordon asked 
Mr. Greason “What is safe enough, and who should verify that!” Mr. Greason re- 
plied: 

“I mean, it’s safe enough when the customers start to show up, and you go 
through a process of demonstrating the vehicle over and over and over again. 
Now, we have our own internal business targets about how safe we have to know 
it is before we can base a business on it. But it’s important to realize that long 
before we get to the point where we know it’s safe enough that our expensive asset 
won’t crash and be lost to revenue service, something we have to do for our own 
business, long before that point, we will have demonstrated safety far superior 
to what people think of as space flight safety as being right now. I mean, the 
test program, alone is probably going to be 50 flights.” 

In a response to a question for the record posed by then-Subcommittee Chairman 
Dana Rohrabacher to Mr. Dennis A. Tito, CEO of Wilshire Associates, Inc, on what 
features of current aircraft standards and space launch safety standards should be 
applied to commercial human space flight, Mr. Tito provided the following response: 
“As I stated in my testimony, commercial aviation is a mature and well-estab- 
lished industry. Aircraft safety standards reflect 100 years of powered flight ex- 
perience, and are part of a 75+ year history of federal regulation increasingly 
focused on protecting the safety of airline passengers as well as uninvolved third 
parties. The commercial space launch industry is a somewhat less mature indus- 
try, with just over two decades of commercial experience. This industry’s herit- 
age, however, is based on over a half-century of military and civilian develop- 
ment and testing of ballistic missiles and their descendant launch vehicles. Mis- 
siles and most current launch vehicles have significant destructive potential and, 
because they are expendable, cannot be flight tested, fixed, and re-tested in the 
way aircraft or other reusable systems can. Launch safety standards have there- 
fore focused on detailed oversight, complex system redundancy and flight termi- 
nation (self-destruct) capabilities. Neither of these two operational safety para- 
digms is appropriate for commercial human space flight. There may be some 
similarities between aircraft and sub-orbital reusable launch vehicles, and others 
between RLVs [Reusable Launch Vehicles] and expendable rockets. However, I 
predict that these new space planes will in fact merit their own operational safe- 
ty approaches. At this point, we need to develop and fly some vehicles so we can 
learn what to do and what not to do. That, after all, is the beauty of the competi- 
tive marketplace: better ideas are rewarded while less-good approaches suffer 
until they are improved or die off.” 

Responding to a similar question for the record by Mr. Gordon on whether the 
government should certify the safety of his vehicles prior to commencement of pas- 
senger-carrying operations, Mr. Greason replied: 

“The government should absolutely not certify the safety of our vehicles prior to 
the commencement of commercial, passenger-carrying operations. Today, we have 
a gap of one-million-to-one between the safety of space flight (roughly 40 fatali- 
ties per thousand emplanements for U.S. space missions) and aircraft (roughly 
25 fatalities per billion emplanements for U.S. scheduled air carriers). When 
aviation started, its accident rate was as bad or worse than today’s space trans- 
portation technology. In the early days, carrying passengers for “barnstorming” 
was one of the few sources of revenue in the aircraft industry. Today, risk toler- 
ance is lower than in the 1920s. We believe we can and must do better. But if 
commercial RLV operators are ten times safer than government space flight ef- 
forts (which may be achievable), that is still 100,000 times less safe than air- 
craft. We are clearly too early for any kind of certification regime as that prac- 
ticed in commercial aviation. 

Early generation RLVs should be allowed to fly as long as the uninvolved gen- 
eral public are kept reasonably safe. The key is a system which investigates fail- 
ures and shares the methods used successfully. The best and fastest path to safe- 
ty is establishing a regulatory culture of continuous improvement based on expe- 
rience; and the more flights we get, the faster we will gain that experience. At- 
tempts to shortcut this process by establishing standards based on guesses or 
predictions about future technologies will stifle innovation, fix in place present 
practices, and slow the pace of safety improvement. This might not be so bad if 
the current safety record of space transportation were something to preserve. But 
it is not; it is something to change for the better.” 

“The current safety situation will change when operational track records are es- 
tablished. It is very likely that there will be dramatic differences in safety be- 
tween vehicle types. When that happens, AST, industry, and the NTSB need to 
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collaborate on raising the bar, perhaps by establishing minimum safety records, 
perhaps by design standards, or a mix of both. As this evolves, it will be impor- 
tant to avoid applying these new regulations to vehicle test flights. Research and 
development test flights should continue with the sole burden of protecting the 
safety of the general uninvolved public. In this way we can hope that people will 
look back on the first century of private space flight and see the same dramatic 
improvement in safety which has been demonstrated by aircraft.” 

In addition to illuminating the discrepancy between the schedule predictions of 
the emerging commercial providers and their actual performance to date, the testi- 
mony cited above raises the policy issue of the potential impact of a decision to re- 
quire NASA to rely on commercially provided crew transportation services, which 
would have to meet NASA’s safety requirements prior to NASA having its astro- 
nauts utilize those services. Given that the emerging commercial providers appear 
to believe strongly in an evolutionary approach to design and safety innovation to 
be achieved through flight experience gained from revenue flights undertaken with- 
out any prior safety certification regime, premature reliance on the government as 
the dominant/only customer would call into question the ability of the emerging 
commercial providers to sustain the approach to innovation that they appear to be- 
lieve is essential to their long-term success. 

NASA’s Incorporation of Safety Measures into Its Human Space Flight Programs 
Several key safety initiatives were undertaken by NASA following the experience 
gained from flight missions: 

• In January 1986, the Space Shuttle Challenger and its crew were lost 73 sec- 
onds after launch because of the failure of a seal (an 0-ring) between two seg- 
ments of a Solid Rocket Booster. In response to the findings of the Rogers 
Commission that investigated the Challenger accident, NASA established 
what is now known as the Office of Safety and Mission Assurance (OSMA) 
at Headquarters to independently monitor safety and ensure communication 
and accountability agency-wide. The Office monitors “out of family” anomalies 
and establishes agency-wide Safety and Mission Assurance policy and guid- 
ance such as human-rating requirements to which NASA program managers 
must adhere. OSMA also reviews the Space Shuttle Program’s Flight Readi- 
ness Process and signs the Certificate of Flight Readiness. 

• In February 2003, Shuttle Columbia disintegrated as it returned to Earth. In 
the ensuing investigation by the Columbia Accident Investigation Board 
(CAIB), the CAIB found that Columbia broke apart from aerodynamic forces 
after the left wing was deformed from the heat of gases that entered the wing 
through a hole caused during launch by a piece of foam insulation that de- 
tached from the External Tank. The CAIB found that the tragedy was caused 
by technical and organizational failures and provided 29 recommendations. 
Then-NASA Administrator Sean O’Keefe requested that Lt. Gen. Thomas 
Stafford, U.S. Air Eorce (Ret.) assign his Task Force on International Space 
Station Operational Readiness to undertake an assessment of NASA’s plans 
to return the Space Shuttle to flight. At that time, the Stafford Task Force 
was a standing body chartered by the NASA Advisory Council, an inde- 
pendent advisory group to the NASA Administrator. Lt. Gen. Stafford acti- 
vated a sub-organization with Col. Richard O. Covey, U.S. Air Force (Ret.) 
leading the day-to-day effort of conducting an independent assessment of the 
15 CAIB “return-to-flight” recommendations. As a result, the Return to Flight 
Task Group was chartered in July 2003. Over the next two years, using ex- 
pertise from academia, aerospace industry, the federal government, and the 
military, the task group, with Lt. Gen. Stafford and Col. Covey as co-chairs, 
assessed the actions taken by NASA to implement the 15 CAlB return-to- 
flight recommendations plus one additional item the Space Shuttle Program 
assigned to itself as a “raising the bar” action. The task group conducted fact- 
finding activities, reviewed documentation, held public meetings, reported the 
status of its assessments to NASA’s Space Flight Leadership Council, and re- 
leased three interim reports. The task group issued its final report (dated 
July 2005) on August 17, 2005. 

Lt. Gen. Stafford will be a witness at the hearing and can provide insights 
into safety challenges associated with human space flight. 

• Among the CAIB’s recommendations was one for NASA to establish an inde- 
pendent Technical Engineering Authority responsible for technical require- 
ments and all waivers to them. In response, NASA created the NASA Engi- 
neering and Safety Center’s (NESC) whose mission is to perform value-added 
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independent testing, analysis, and assessments of NASA’s high-risk projects 
to ensure safety and mission success. 

According to NASA, rather than relieving NASA program managers of their 
responsibility for safety, the NESC complements the programs by providing 
an independent technical review. Additionally, NASA states that the NESC 
provides a centralized location for the management of independent engineer- 
ing assessment by expert personnel and state of the art tools and methods 
for the purpose of assuring safety. The NESC Management Office is located 
at NASA Langley Research Center in Hampton Virginia, but the NESC has 
technical resources at all 10 NASA Centers and Headquarters, as well as 
partnerships with academia, industry and other Government organizations. 
These technical resources are pooled to perform NESC activities and services. 
Operationally, the NESC falls under the responsibility of NASA’s Office of 
Safety and Mission Assurance. 

• NASA said that it recognized the importance of capturing the lessons learned 
from the loss of Columbia and her crew to benefit future human exploration, 
particularly future crewed vehicle system design. Consequently, the Space 
Shuttle Program commissioned the Spacecraft Crew Survival Integrated In- 
vestigation Team (SCSIIT) to perform a comprehensive analysis of the acci- 
dent, focusing on factors and events affecting crew survival; and to develop 
recommendations for improving crew survival for all future human space 
flight vehicles. The Team’s final report was released in December 2008, al- 
though findings were shared within NASA during the 3-year effort. Some il- 
lustrative recommendations with regards to future space craft design were as 
follows: 

• “Future spacecraft seats and suits should be integrated to ensure proper 
restraint of the crew in offnominal situations while not affecting oper- 
ational performance. Future crewed spacecraft vehicle design should ac- 
count for vehicle loss of control to maximize the probability of crew sur- 
vival.” 

• “Future vehicle design should incorporate an analysis for loss of control! 
breakup to optimize for the most graceful degradation of vehicle systems 
and structure to enhance chances for crew survival. Operational proce- 
dures can then integrate the most likely scenarios into survival strategies.” 

• “Future spacecraft crew survival systems should not rely on manual acti- 
vation to protect the crew.” 

The Constellation Program’s design is in conformance with the Team’s findings. 
For example, with regards to the recommendation listed above on crew restraint, 
the program has (a) outfitted the Orion seats with the latest innovations in seat and 
restraint systems for enhanced occupant protection; (b) implemented limb flail re- 
quirements and additional protections to ensure proper arm positioning to maintain 
control of the vehicle under high acceleration events; and (c) is designing suit and 
seat in an integrated fashion with the entire spacecraft. 

Mr. Jeff Hanley, Program Manager of the Constellation Program, will be a wit- 
ness at the hearing and can provide additional details on how that Program is incor- 
porating safety and applicable human-rating requirements, as well as Astronaut Of- 
fice input on launch/entry systems safety, into the Constellation program’s design, 
development, and testing activities. 

NASA’s Human Rating and Safety Requirements 

According to NASA’s Inspector General, NASA assembled a diversified group in 
2007 composed of astronauts, engineers, safety engineers, flight surgeons, and mis- 
sion operations specialists to rewrite the agency’s human-rating requirements, 
which had been embodied in NPR 8705. 2A, “Human-Rating Requirements for Space 
Systems.” As stated in the NASA Inspector General’s report IG-09-016 dated May 
21, 2009: 

“This group reviewed human-rating documents from the last 45 years that were 
used in the development of Mercury, Gemini, Apollo, Skylab, the Space Shuttle, 
and the International Space Station. The lessons learned from these programs, 
and information from numerous books and studies, resulted in NPR 8705.2B, 
issued May 6, 2008.” 

The stated purpose of NPR 8705. 2B is “to define and implement the additional 
processes, procedures, and requirements necessary to produce human-rated space sys- 
tems that protect the safety of crew members and passengers on NASA space mis- 
sions.” 
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The NPR states that “a human-rated system aeeommodates human needs, effec- 
tively utilizes human capabilities, controls hazards and manages safety risk associ- 
ated with human spaceflight, and provides, to the maximum extent practical, the ca- 
pability to safely recover the crew from hazardous situations. Human-rating is not 
and should not be construed as certification for any activities other than carefully 
managed missions where safety risks are evaluated and determined to be acceptable 
for human spaeeflight.” 

The NPR further states that “Human-rating must be an integral part of all pro- 
gram activities throughout the life cyele of the system, including design and develop- 
ment; test and verification; program management and control; flight readiness cer- 
tification; mission operations; sustaining engineering; maintenance, upgrades, and 
disposal.” 

As to applicability, the NPR states that “The human-rating requirements in this 
NPR apply to the development and operation of crewed spaee systems developed by 
NASA used to eonduct NASA human spaceflight missions. This NPR may apply to 
other erewed space systems when documented in separate requirements or agree- 
ments.” The NPR notes that “The Space Shuttle, the International Spaee Station 
(ISS), and Soyuz spacecraft are not required to obtain a Human-Rating Certification 
in accordance with this NPR. These programs utilize existing policies, procedures, 
and requirements to certify their systems for NASA missions.” The NPR is applicable 
to the Constellation Program. 

The NPR views human-rating as consisting of three fundamental tenets: 

1. Human-rating is the process of designing, evaluating, and assuring that the 
total system can safely conduct the required human missions. 

2. Human-rating includes the incorporation of design features and capabilities 
that accommodate human interaction with the system to enhance overall 
safety and mission success. 

3. Human-rating includes the incorporation of design features and capabilities 
to enable safe recovery of the crew from hazardous situations. 

According to NASA’s guidance, human-rating is an integral part of all program 
activities throughout the life cycle of the system, including design and development; 
test and verification; program management and control; flight readiness certifi- 
cation; mission operations; sustaining engineering; maintenance/upgrades; and dis- 
posal. 

The NPR technical requirements for human-rating address system safety, crew/ 
human control of the system, and crew survival/aborts. The requirements associated 
with crew survival and abort capability were established following the two pre- 
viously cited Shuttle accidents. For example, the NPR states that for Earth Ascent 
Systems: 

• “The spaee system shall provide the capability for unassisted crew emergency 
egress to a safe haven during Earth prelauneh activities.” 

• “The space system shall provide abort capability from the launch pad until 
Earth-orbit insertion to protect for the following ascent failure scenarios (min- 
imum list): 

a. Complete loss of ascent thrust ! propulsion 

b. Loss of attitude or flight path.” 

• “The crewed space system shall monitor the Earth ascent launch vehicle per- 
formance and automatically initiate an abort when an impending catastrophic 
failure is detected.” 

Regarding Earth ascent abort, the NPR states that: 

• “The space system shall provide the capability for the crew to initiate the 
Earth ascent abort sequence.” 

• “The space system shall provide the capability for the ground control to initiate 
the Earth ascent abort sequence.” 

• “If a range safety destruct system is incorporated into the design, the space sys- 
tem shall automatically initiate the Earth ascent abort sequence when range 
safety destruct commands are received onboard, with an adequate time delay 
prior to destruction of the launch vehicle to allow a successful abort.” 

Once in orbit, the NPR requires the crewed space system to “provide the capa- 
bility to autonomously abort the mission from Earth orbit by targeting and per- 
forming a deorbit to a safe landing on Earth.” 

In addition, NPR 8715. 3C which establishes NASA’s General Safety Program Re- 
quirements, has a section entitled “Hazardous Work Activities That Are Outside 
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NASA Operational Control.” The NPR states that it is NASA policy to “document 
and verify that risks are adequately controlled and any residual risk is acceptable”. 
Applicability to commercial human space flight is cited. Specifically, Section 1.14.1 
states: 

“It is NASA policy to formally review and approve NASA participation in haz- 
ardous work activities that are outside NASA operational control as needed to 
ensure that NASA safety and health responsibilities are satisfied. This policy ap- 
plies unconditionally to NASA participation in commercial human spaceflight 
where current federal regulations do not necessarily provide for the safety of 
spaceflight vehicle occupants. This policy is non-retroactive and applies to haz- 
ardous ground or flight activities that involve research, development, test and 
evaluation, operations, or training, where all five of the following conditions 
exist: 

a. NASA civil service personnel. Government detailees, specified contractors, 
or specified grantees are performing work for NASA. 

b. The activity is outside NASA’s direct operational control / oversight. 

c. An assessment by the responsible NASA manager indicates there are in- 
sufficient safeguards and! or oversight in place. 

d. The activity is not covered by a basic contract, grant, or agreement where 
Federal, State, and lor local requirements address personnel safety. 

e. The nature of the activity is such that, if NASA were controlling it, a for- 
mal safety and! or health review would be required as part of the NASA 
approval process.” 

In terms of responsibilities, the NASA Associate Administrator, as chair of the 
Agency Program Management Council, is the authority for human-rating and is re- 
sponsible for certif 3 dng systems as human-rated. In this capacity, the NASA Asso- 
ciate Administrator makes the determination to certify a system as human-rated. 
Appeals for exceptions and waivers to the NPR are made to the NASA Associate 
Administrator. The Chief, Safety and Mission Assurance, is the Technical Authority 
for Safety and Mission Assurance and is responsible for assuring the implementa- 
tion of safety-related aspects of human-rating. 

In its 2008 Annual Report, the Aerospace Safety Advisory Board (ASAP), the con- 
gressionally established body which evaluates and provides advice on NASA’s safety 
performance, noted changes in NPR 8705. 2B from the prior guidance: 

“The ASAP is concerned about HER [human rating requirements] substance, ap- 
plication, and standardization NASA-wide. 

• After several briefings, the Panel is just beginning to fully understand the 
changes (e.g., in failure tolerance, inadvertent actions, redundancy, and inte- 
grated design analysis) and the implications for future system development — 
an index of the challenge facing NASA. 

• The new HER standards move from validating compliance with mandatory 
failure tolerance requirements to an approach of designing to acceptable risk, 
but without any apparent clear and visible criteria for estimating “how safe 
is safe enough” for various mission categories. 

• A direct linkage between current standards and engineering directives is miss- 
ing. 

• NASA training materials on the new HER standards are still in development 
and should be accelerated to distribute information before new Constellation 
systems are developed.” 

Mr. Bryan O’Connor, Chief of Safety and Mission Assurance and former astro- 
naut, will be a witness at the hearing and can provide additional details on OSMA’s 
latest activities associated with implementing safety-related aspects of human-rat- 
ing, including addressing the ASAP’s concerns. Mr. John Marshall, a member of the 
ASAP, will also be testifying at the hearing. 

Enhancing Safety through Crew Training 

As evidenced by the performance of the crew of Apollo 13 after the incident that 
created a serious emergency situation en route to the Moon, astronauts play a major 
role in ensuring human safety in space. In that situation, the crew detected, reacted, 
and with the help of engineers and technicians on the ground, overcame problems 
that mechanical systems could not. Integral to that crew’s ability to improvise under 
difficult conditions was the training they received. 
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Today’s astronaut training program builds on years of flight experience. Once se- 
lected as candidates, astronauts undergo a rigorous training program that ranges 
from basic training in generic vehicle systems to being trained to operate spacecraft 
systems using simulators. Survival training includes emergency egress from the 
Shuttle and surviving in a water or wilderness environment. As a final step, crews 
conduct integrated operational training with flight controllers in NASA’s Mission 
Control Center at the Johnson Space Center. 

Training for off-nominal operations is an important facet of crew training. Astro- 
nauts are acquainted with non-safety-critical failure modes and the ways to respond 
to them. Training for off-nominal conditions is primarily accomplished by inserting 
failures during simulations at which time astronauts are trained to recognize the 
off-nominal conditions and identify corrective measures. The level of difficulty arises 
when several failures are injected during simulations and crew members must per- 
form failure analyses in an integrated manner and apply corrective procedures in 
sequence. Emergency training is needed for those situations where all measures 
identified through other forms of training cannot be used. The most critical emer- 
gencies primarily involve fire, depressurization, and toxic contamination. The goal 
of NASA’s training is to have a trained astronaut who is able to respond and assist 
in any contingency situation that may arise. 

Safety Considerations in NASA’s Selection of Space Exploration Vehicles 

In January 2004, President Bush announced his Vision for Space Exploration, 
which called for NASA to safely return the Space Shuttle to flight; complete the 
International Space Station (ISS); return to the Moon to gain experience and knowl- 
edge for human missions beyond the Moon, including Mars; and increase the use 
of robotic exploration to maximize our understanding of the solar system and pave 
the way for more ambitious human missions. Congressional support for a new direc- 
tion in the Nation’s human spaceflight program was clearly articulated in the 2005 
NASA Authorization Act. Specifically, the Act directed the NASA Administrator “to 
establish a program to develop a sustained human presence on the Moon, including 
a robust precursor program, to promote exploration, science, commerce, and United 
States preeminence in space, and as a stepping-stone to future exploration of Mars 
and other destinations. The Administrator was further authorized to develop and 
conduct appropriate international collaborations in pursuit of these goals.” 

Shortly after Dr. Michael Griffin was named the new NASA Administrator in 
April 2005, he set out to restructure the Exploration Program by giving priority to 
accelerating the development of the Crew Exploration Vehicle (CEV) to reduce or 
eliminate the anticipated gap in U.S. human access to space following the retire- 
ment of the Space Shuttle. Specifically, he established a goal for the CEV to begin 
operation as early as 20 Hand to be capable of ferrying crew and cargo to and from 
the ISS. He also decided to focus on existing technology and proven approaches for 
exploration systems development. In order to reduce the number of required 
launches for exploration missions and to ease the transition after Space Shuttle re- 
tirement in 2010, the Administrator, consistent with the congressional guidance con- 
tained in the NASA Authorization Act of 2005, directed the Agency to examine the 
cost and benefits of developing a Shuttle-derived Heavy-Lift Launch Vehicle to be 
used in lunar and Mars exploration. As a result, the Exploration Systems Architec- 
ture Study (ESAS) team was established to determine the best exploration architec- 
ture and strategy to implement these changes. 

In November 2005, NASA released the results of the ESAS, an initial framework 
for implementing the VSE and a blueprint for the next generation of spacecraft to 
take humans back to the Moon and on to Mars and other destinations. ESAS made 
specific design recommendations for a vehicle to carry crews into space, a family of 
launch vehicles to take crews to the Moon and beyond, and a lunar mission “archi- 
tecture” for human lunar exploration. ESAS presented a time-phased, evolutionary 
architectural approach to returning humans to the Moon, servicing the ISS after the 
Space Shuttle’s retirement, and eventually transporting humans to Mars. Under the 
2005 ESAS plan, a Crew Exploration Vehicle (CEV and now called Orion) and Crew 
Launch Vehicle (CLV and now called Ares I) development activities would begin im- 
mediately, leading to the goal of a first crewed flight to the ISS in 2011. Options 
for transporting cargo to and from the ISS would he pursued in cooperation with 
industry, with a goal of purchasing transportation services commercially. In 2011, 
the development of the major elements required to return humans to the Moon 
would begin — the lunar lander (now called Altair), heavy lift cargo launcher (now 
called Ares V), and an Earth Departure Stage vehicle. These elements would be de- 
veloped and tested in an integrated fashion, with the internal goal of a human lunar 
landing in 2018. When resources needed to achieve the 2011 goal for CEV oper- 
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ations were not forthcoming, the Constellation Program established a formal target 
of 2015 for initial CEV flights to the ISS. 

According to the ESAS report, the team’s major trade study was a detailed exam- 
ination of the relative costs, schedule, reliability, safety, and risk of using DoD’s 
Evolved Expendable Launch Vehicle (EELV) and Shuttle derived launchers for crew 
and cargo missions. Among its operational ground rules and assumptions was the 
CAIB finding on the desirability of an architecture that will “separate crew and 
large cargo to the maximum extent practical”. 

The EELV options examined for suitability for crew transport by the ESAS team 
were derived from the Delta LV and Atlas V families. The team found that: 

• None of the medium versions of either vehicle had the capability to accommo- 
date CEV lift requirements. Augmentation of the medium-lift class systems 
with solid strap-on boosters was thought by the team to pose an issue for 
crew safety because of small strap-on Solid Rocket Motor reliability. 

• Both vehicles required modification for human-rating, particularly in the 
areas of avionics, telemetry, structures, and propulsion systems. 

• Both Atlas- and Delta-derived systems required new upper stages to meet the 
lift and human rating requirements. 

• Both Atlas and Delta single-engine upper stages fly highly lofted trajectories, 
which can produce high deceleration loads on the crew during an abort an, 
in some cases, can exceed crew load limits as defined by NASA standards. 

CLV options derived from Shuttle elements focused on the configurations that 
used a Reusable Solid Rocket Booster (RSRB), either as a four-segment version 
nearly identical to the RSRB flown today or a higher-performance five-segment 
version of the RSRB. The team sought to develop options that could meet the lift 
requirement using a four-segment RSRB. To achieve this, a 500,000-lbf vacuum 
thrust class propulsion system would be needed. Two types of upper stage engines 
were assessed. According to ESAS, the option chosen, including using the Space 
Shuttle Main Engine (SSME) for the upper stage, was selected due to projected 
lower cost, higher safety/reliability, its ability to utilize existing human-rated sys- 
tems and infrastructure and the fact that it gave the most straightforward path to 
a heavy lift launch vehicle for cargo. Subsequently, to achieve lower recurring costs, 
the rocket motor powering the upper stage was changed to a variant of the J-2S 
Saturn-era motor and now called J-2X. 

The following chart from the ESAS report summarizes the team’s findings with 
regards to CLV options and compares these options on the basis of Loss of Mission 
(LOM) and Loss of Crew (LOC) probabilities: 
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Source: NASA (ESAS) 

With regards to crew safety, as shown in the table above, analysis by the ESAS 
team showed that the initially recommended concept had a mean LOG of 1 in 2,021 
and the current design had a mean LOG of 1 in 1,918. As such, initially both con- 
cepts met the recommendations from the GAIB and the Astronaut’s Office that a 
Shuttle replacement have at least a LOG of 1 in 1,000 missions. In comparison, the 
other options ranged from 1 in 614 to 1 in 1,100. The selected GLV design, which 
later became known as Ares I, was also projected to offer significant improvement 
in Loss of Mission over other launch options. 

In his presentation to the Augustine Gommittee on July 29, 2009, Dr. Joseph 
Eragola, a member of the ESAS team and Vice President of Valador, Inc., told the 
Gommittee that this meant that “Ares I is at least a factor of 2 safer from a loss 
of crew perspective and in some cases closer to a factor of 3.” In a recent conversation 
between Subcommittee staff and Dr. Eragola, he indicated that the ESAS team was 
more interested in establishing the relative risk among the options and not in their 
absolute risk values. According to NASA, the recommended concept’s lower LOG es- 
timate is a direct reflection of the use of a simpler design and fewer moving parts 
characteristic of a single solid propellant first stage. The recommended concept was 
accepted and formed the basis of the Ares I crew launch vehicle. 

Dr. Eragola will be a witness at the hearing and can provide additional details 
on the ESAS Team’s analysis of how alternative configurations compared with re- 
gards to loss of crew and loss of mission projections. 

Safety Oversight by the Aerospace Safety Advisory Panel 

Since it was established in 1968 by Gongress, the Aerospace Safety Advisory 
Panel (ASAP) has been evaluating NASA’s safety performance and advising the 
agency on ways to improve that performance. The Panel consists of members ap- 
pointed by the NASA Administrator and is comprised of recognized safety, manage- 
ment, and engineering experts from industry, academia, and other government 
agencies. 

The ASAP reports to the NASA Administrator and Gongress. The Panel was es- 
tablished by Gongress in the aftermath of the January 1967 Apollo 204 spacecraft 
fire. The Panel’s statutory duties, as prescribed in Section 6 of the NASA Authoriza- 
tion Act of 1968, Public Law 90-67, 42 U.S.G. 2477 are as follows: 

“The Panel shall review safety studies and operations plans that are referred to 
it and shall make reports thereon, shall advise the Administrator with respect 
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to the hazards of proposed operations and with respect to the adequacy of pro- 
posed or existing safety standards, and shall perform such other duties as the 
Administrator may request.” 

The Panel was authorized in Section 106, Safety Management, of the National 
Aeronautics and Space Administration Authorization Act of 2005, [P.L. 109-155]. 
The ASAP bases its advice on direct observation of NASA operations and decision- 
making. The Panel provides an annual report. In addition to examining NASA’s 
management and culture related to safety, the report also examines NASA’s compli- 
ance with the recommendations of the CAIB. Advice from the ASAP on technical 
authority, workforce and risk management practices has been provided to the NASA 
Administrator. 

Critical human space flight safety issues the Panel identified in its 2008 Annual 
Report included the proposed extension of the Space Shuttle Program; the use of 
commercial transportation sources; the safety and reliability of the Russian Soyuz 
spacecraft; an opportunity to hardwire safety into the fabric of the Constellation 
Program; the suitability of agency management approaches; and technical Stand- 
ards Program focused on safety and risks. 

In his testimony at the Subcommittee’s June 2009 hearing on “External Perspec- 
tives on the FY 2010 NASA Budget Request and Related Issues”, the ASAP witness 
stated that while the Panel endorses and supports investing in a Commercial Or- 
bital Transportation Services (COTS) program, it believes “at this juncture that 
NASA needs to take a more aggressive role articulating human rating requirements 
for the COTS Program since most programs are well underway. To do otherwise 
may, at a later time, pressure NASA into accepting a system for expediency that is 
below its normal standard for safety”. In its 2008 report, the ASAP stated: 

“COTS vehicles currently are not subject to the Human-Rating Requirements 
(HRR) standards and are not proven to be appropriate to transport NASA per- 
sonnel.” 

and 

“The capability of COTS vehicles to safely dock with the ISS still must be dem- 
onstrated.” 

In addition to its annual report, the Panel submits Minutes with recommenda- 
tions to the NASA Administrator resulting from its quarterly meetings. The Panel 
held its Third Quarterly Meeting in July 2009 [the Panel’s most recent Quarterly 
Meeting was held on October 22, 2009 at the Kennedy Space Flight Center]. At that 
meeting, the Panel’s official minutes referenced the panel’s continuing concerns re- 
garding the application of human rating criteria to commercial crew transportation 
services: 

“As far as the safety issues, they basically boil down to expanding the cargo ca- 
pability to include crew. If that is done, the traditional method would be to apply 
full human rating criteria initially at the beginning of the program’s develop- 
ment. However, thus far NASA has consciously chosen to not use a traditional 
approach, and there yet have been any performance requirements identified to 
put crews on board a COTS vehicle. The Panel previously had made a rec- 
ommendation regarding this issue and continues to be perplexed as to why 
NASA has delayed this important action.” 

“The Panel has addressed its concern in its previous quarterly and annual re- 
ports. The issue is becoming more focused and more urgent. The prospect of a 
COTS delivery of cargo to space is organizationally and politically simpler than 
crew transport. The issue of human rating with COTS and the delivery of NASA 
astronauts into space is the primary concern. Admiral Dyer [Chairman of the 
ASAP] noted that the Panel remains concerned that in the probing of this ques- 
tion, NASA looks to the FAA, which doesn’t have the institutional history and 
people to speak clearly to the topic. This issue represents an opportunity for im- 
proved interagency performance.” 

Admiral Dyer also noted at the July meeting that “If the [commercial] vehicle is 
being designed to be a cargo hauler, that is a different mission and a different set 
of designs than a crew transporter.” Mr. John Frost, a Panel member, added that 
“the human rating requirements for the Agency are built around the design process 
and those processes are ongoing now at the COTS contractors. It would be problem- 
atic to come back later to put these requirements into a process that is already com- 
plete.” 

As mentioned above, Mr. John Marshall, a member of the ASAP, will be a witness 
at the hearing and can provide additional details on the Panel’s work and safety- 
related concerns. 
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Commercially Provided Crew and Cargo Space Transportation Services 

At present there are no commercially owned and operated human space transpor- 
tation systems in service. Only one company, Scaled Composites, has successfully 
launched and returned humans safely to space and hack on suborbital flights in an 
experimental spacecraft [SpaceShipOne] and launch system. Virgin Galactic intends 
to purchase operational vehicles from Scaled Composites and enter into commercial 
operations. Originally slated to enter into commercial operations in 2007, they are 
currently projecting a 2011 debut for SpaceShipTwo’s suborbital flight operations. 
Several other companies/ventures also have plans to take paying passengers on sub- 
orbital ’tourism’ trips, but have not yet flown any craft to space with humans 
aboard. 

Along with space tourism, the ‘NewSpace’ community has stated that suborbital 
services will be able to provide opportunities for suborbital science experiments, sub- 
orbital travel and package delivery. According to members of this ‘Newspace’ com- 
munity, after carrying out suborbital business operation, a number of them have 
hopes of being able to undertake orbital operations in the future. However, there 
are a number of regulatory concerns and technical issues that would have to be ad- 
dressed, as well as significant investments made, before such a future could be real- 
ized. Orbital flight operations are considered significantly more challenging than 
suborbital flight operations. 

Commercial Orbital Transportation Services Demonstrations 

Under the Commercial Orbital Transportation Services (COTS) Demonstration 
project, NASA is helping industry develop and demonstrate cargo space transpor- 
tation capabilities. According to NASA, the COTS project provides a vehicle for in- 
dustry to lead and direct its own efforts with NASA providing technical and finan- 
cial assistance. NASA will invest approximately $500 million toward cargo space 
transportation flight demonstrations. There are currently two funded participants in 
the COTS demonstration project, namely Space Exploration Technologies (SpaceX) 
and Orbital Sciences Corporation (Orbital). 

According to NASA, as of September 16, 2009, SpaceX had completed 15 of 22 
milestones and has received a total of $243 million in payments, with $35 million 
available for the remaining milestones. Milestone tasks range from Project Plan Re- 
view to Flight Demonstration. SpaceX has begun manufacturing the flight Dragon 
capsule and Falcon 9 launcher to be used for the COTS demonstration flight 1. 
Under the terms of the current Space Act Agreement, SpaceX was scheduled to com- 
plete its first demonstration flight in June 2009 (The initial Space Act Agreement 
between NASA and SpaceX was signed in August 2006 and called for a scheduled 
first demonstration flight by September 2008). 

To allow additional time for Dragon and Falcon 9 manufacturing and testing pro- 
grams, SpaceX indicated in June 2009 that it expected to complete its first dem- 
onstration flight in January 2010, with the second and third flights then planned 
for June 2010 and August 2010, respectively. However, making the first COTS dem- 
onstration flight in January 2010 will be challenging. According to an October 29th, 
2009 Space News article, development of the Falcon 9 rocket — along with that of its 
smaller sibling, the Falcon 1 — has taken longer than SpaceX expected. The same 
Space News article reports that SpaceX’s range request for the inaugural Falcon 9 
flight made for February 2010 conflicts with another already approved launch. This 
is significant because of the relationship between the Falcon 9 inaugural flight and 
the first COTS demonstration flight. The first COTS flight must receive an FAA li- 
cense before it is launched. In its June 2009 briefing to the Augustine Committee, 
SpaceX projected that the first COTS demonstration flight would occur 2 months 
after the inaugural Falcon 9 flight. The smaller Falcon 1, which is designed for 
transport of satellites to low Earth orbit and is not part of the COTS project, has 
encountered its share of developmental challenges. In July 2009, Falcon 1 success- 
fully delivered the Malaysian RazakSAT satellite to orbit. Prior to a successful test 
flight in September 2008 at which time a dummy payload reached orbit, there had 
been three unsuccessful Falcon 1 flights, the first of which occurred in March 2006. 

As of September 16, 2009, NASA says that Orbital has completed 10 of its 
planned 19 milestones and has received a total of $120 million to date with an addi- 
tional $50 million available for future milestones. The Orbital demonstration flight 
is currently planned for March 2011 due to the company’s decision to change its 
cargo transportation architecture from an unpressurized (external) cargo system to 
a pressurized (internal) cargo system. The initial Space Act Agreement signed in 
February 2008 had a scheduled first demonstration flight date of December 2010. 

According to NASA, the agency will not pay for any milestone until the milestone 
is successfully completed per the Space Act Agreement and approved by the agency. 
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Should a milestone be missed, NASA says that it will evaluate partner progress 
made and recommend future actions that are in the best interest of the government. 

Commercial Resupply Services 

In December 2008, NASA awarded contracts to two companies for the delivery of 
cargo to the ISS after the retirement of the Space Shuttle. The successful bidders 
for Commercial Resupply Services (CRS) contracts were Orbital and SpaceX, the two 
COTS demonstration program funded participants. NASA says that it awarded two 
contracts to mitigate the risk of being dependent on a single contractor. A protest 
lodged to the Government Accountability Office (GAO) in January 2009 by 
PlanetSpace, Inc, an unsuccessful bidder, was subsequently denied by GAO in April 
2009. 

The scope of the CRS effort includes the delivery of pressurized and/or unpres- 
surized cargo to the ISS and the disposal or return of cargo from the ISS. In addi- 
tion, there are non-standard services and special task assignments and studies that 
can be ordered to support the primary standard resupply service. NASA ordered 8 
flights valued at $1.88 billion from OSC and 12 flights valued at $1.59 billion from 
SpaceX. According to NASA’s press release announcing the contracts, the maximum 
potential value of each contract is $3.1 billion. Based on known requirements, the 
combined value of the two awards is projected at $3.5 billion. 

Each award under the contracts calls for the delivery of a minimum of 20 metric 
tons of cargo to the ISS, as well as the return or disposal of 3 metric tons of cargo 
from the orbiting complex. The CRS contracts are firm-fixed price, Indefinite Deliv- 
ery Indefinite Quantity procurements with a period of performance from January 
1, 2009, through December 30, 2015. 

Commercial Crew Transportation Services 

Although NASA currently has no contracts for the transportation of crew by com- 
mercially provided space transportation services [which do not at present exist], it 
has recently applied funds from the American Recovery and Reinvestment Act of 
2009 to work on the Commercial Crew and Cargo Program: 

• A modification to the Bioastronautics contract with Wyle Integrated Science 
& Engineering Group was made to develop a set of human system integration 
requirements for application to commercial spacecraft in support of NASA’s 
Commercial Crew and Cargo Program. According to NASA, the human sys- 
tem integration requirements developed under this task order will be based 
on a review of existing Human Rating requirements. Spaceflight Human Sys- 
tems Standards, Constellation Program requirements. Commercial Crew and 
Cargo Program Office operational concepts and requirements, and the John- 
son Space Center Space Life Sciences Directorate Human Interface Design 
Handbook. 

• NASA’s Commercial Crew and Cargo Program is applying Recovery Act funds 
to solicit proposals from all interested U.S. industry participants to mature 
the design and development of commercial crew spaceflight concepts and asso- 
ciated enabling technologies and capabilities. NASA plans to use its Space Act 
authority to invest up to $50 million dollars in multiple competitively award- 
ed, funded agreements. This activity is referred to as Commercial Crew De- 
velopment, or CCDev. 

Commercial Spaceflight Federation 

According to the Commercial Spaceflight Federation (CSF), its mission is to “pro- 
mote the development of commercial human spaceflight, pursue ever higher levels of 
safety, and share best practices and expertise throughout the industry. CSF member 
organizations include commercial spaceflight developers, operators, and spaceports”. 
The Commercial Spaceflight Federation is governed by a board of directors, com- 
posed of the member companies’ CEO-level officers and entrepreneurs. 

The Federation recently voiced strong support for the report by the Review of U.S. 
Human Space Flight Plans Committee which included in its options the creation of 
a Commercial Crew program to develop commercial capabilities to transport crew 
to the International Space Station. 

Mr. Bretton Alexander, President of the Commercial Spaceflight Federation, will 
be a witness at the hearing and can provide details related to commercial provider 
plans to human rate commercial space transportation systems as well as the com- 
mercial space industry expectations of how NASA’s safety standards and require- 
ments would be applied to commercially crewed spacecraft. 
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Chairwoman Giffords. Good morning. This hearing has now 
come to order. 

This hearing this morning is the latest in a series of hearings 
that this Subcommittee is holding on a critical issue, an issue that 
we will have to take into consideration as Members of Congress 
and also the White House in considering the future direction and 
funding for NASA. In many ways, the topic of today’s hearing is 
one of the most important issues confronting us, namely, how to 
ensure the safety of those brave men and women whom the Nation 
sends into space to explore and push back the boundaries of the 
space frontier. Of course, I am not under any illusion that human 
spaceflight can ever be risk-free. Nothing in life, of course, is. 

The Apollo 1 fire, the Challenger, Columbia, these fatal acci- 
dents, as well as other spaceflight incidents that could have led to 
loss of life, have driven that point home in stark and tragic terms. 
Indeed, this Subcommittee is holding today’s hearing because we 
need to be sure that any decision being contemplated by the White 
House or by the Congress are informed by our best understanding 
of the fundamental crew safety issues facing our human spaceflight 
program. And in making those decisions, we should not let either 
advocacy or unexamined optimism replace probing questions and 
thoughtful analysis. 

That is why the Subcommittee has invited this distinguished 
panel of witnesses to appear before us today. We need the benefit 
from your perspective and experience as we examine critically im- 
portant questions that Congress will need to have answered if we 
are to assess the various proposals that are being put forth. 

Much has been said about the potential future plans for explo- 
ration in recent months, but there has been precious little discus- 
sion about safety. Today’s hearing is the first step in rectifying that 
situation. 

Let me list just a few questions that we hope our witnesses will 
answer today. As several of the witnesses have put in their pre- 
pared testimony, the Constellation program strove to respond to 
the recommendations of the Columbia Accident Investigation Board 
that the design of the system that replaces the shuttle should give 
overriding priority to crew safety. The result is a system that is 
calculated to be significantly safer than the space shuttle, and two 
to three times safer than the alternative approaches considered by 
NASA. Given that, we hope that our witnesses as to whether — we 
will hear from them whether or not they believe that the burden 
of proof should be put on those who would propose alternatives to 
Constellation to demonstrate that their systems will be at least as 
safe as Ares and Orion. Alternatively, we would like to hear wheth- 
er or not it would be acceptable to reduce the required level of crew 
safety on commercially provided crew transport services used to 
transport U.S. astronauts much below what looks likely to be 
achievable in the Constellation program. 

In addition, we need to hear our witnesses’ views on whether the 
timetable suggested for the availability of commercial crew trans- 
port services is realistic or not. That is, when one takes into ac- 
count all of the steps, not just those that are explicitly safety re- 
lated, that will need to be taken before the first NASA astronaut 
can ride to the International Space Station on an operational com- 
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mercial crew vehicle, do our witnesses believe that such vehicles 
will be available in time to meet a significant fraction of NASA’s 
ISS crew transfer and crew rescue needs prior to 2020 or not. Simi- 
larly, given those required steps, do our witnesses believe that 
would-be commercial crew transport service providers will be able 
to garner sufficient revenues from non-NASA passenger transport 
services to remain viable over that same time period or not. 

I ask these questions, and we will hear other questions of course 
from our members, because it is going to be difficult to make rea- 
soned judgments about the wisdom of investing significant tax- 
payer dollars in would-be commercial providers or of altering 
Congress’s commitment to the existing Constellation program in 
the absence of clear answers. 

Finally, what do our witnesses consider to be the most important 
safety-related issues that will need to be addressed if we are to 
make our decisions on the future of NASA’s human spaceflight and 
exploration program, and, at the end of the day, what will Con- 
gress need to do to have the assurance that we have done all we 
can to ensure the safety of our Nation’s future human spaceflight 
activities? This is not a hypothetical question. It is fundamental for 
fulfilling our responsibilities as Members of Congress. With so 
much for our Subcommittee to consider, I am comforted that we 
have a very distinguished panel who can speak with conviction and 
knowledge about safety issues and everything that needs to be con- 
sidered. 

So I welcome all of you to today’s hearing. All of us here of 
course are passionate about space, whether in the private sector or 
the public sector. We want the best possible future for our Nation 
in its space endeavors. I hope that this morning’s hearing will help 
us chart a productive and a responsible path forward. 

And finally, I would be remiss if we did not acknowledge the 
unique contributions of one of our witnesses to the advancement of 
safety in human spaceflight, and I want to welcome each of you to 
our hearing but particularly Gen. Tom Stafford, a veteran of Gem- 
ini, Apollo, Apollo-Soyuz, Shuttle Return to Flight, and countless 
other space flight efforts. He can speak as a true national hero and 
an authority. 

So in closing, I know that my colleagues join me in saying that 
we all owe General Stafford a great amount of debt for everything 
you have done for our country and we are honored, sir, that you 
are here with us today. Thank you. 

[The prepared statement of Chairwoman Giffords follows:] 

Prepared Statement of Chairwoman Gabrielle Giffords 

Good morning. This morning’s hearing is the latest in a series of hearings that 
this subcommittee is holding on critical issues that the White House and Congress 
need to consider as decisions are made on the future direction and funding for 
NASA. In many ways, the topic of today’s hearing is one of the most important 
issues confronting us — namely, how to ensure the safety of those brave men and 
women whom the nation sends into space to explore and push back the boundaries 
of the space frontier. Of course, I am under no illusions that human spaceflight can 
ever be made risk-free. Nothing in life is. 

The Apollo 1 fire, the Challenger and Columbia fatal accidents, as well as other 
space flight incidents that could have led to loss of life, have driven that point home 
in stark and tragic terms. Indeed, this subcommittee is holding today’s hearing be- 
cause we need to be sure that any decisions being contemplated by the White House 
and Congress are informed by our best understanding of the fundamental crew safe- 
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ty issues facing our human space flight program. And in making those decisions, 
we should not let either advocacy or unexamined optimism replace probing ques- 
tions and thoughtful analysis. 

That is why the subcommittee has invited this distinguished set of witnesses to 
appear before us today. We need the benefit of your perspectives and experience as 
we examine critically important questions that Congress will need to have answered 
if we are to assess the various proposals that have been put forth. 

Much has been said about potential future plans for exploration in recent months, 
but there has been precious little discussion of crew safety Today’s hearing is a first 
step in rectifying that situation. 

Let me list just a few of the questions that we would like our witnesses to address 
today. As several of the witnesses at today’s hearing will testify, the Constellation 
program strove to respond to the recommendation of the Columbia Accident Inves- 
tigation Board that “The design of the system [that replaces the Shuttle] should give 
overriding priority to crew safety . . .” The result is a system that is calculated to 
be significantly safer than the Space Shuttle, and two to three times safer than the 
alternative approaches considered by NASA. Given that, we hope to hear from our 
witnesses as to whether they believe that the burden of proof should be put on those 
who would propose alternatives to the Constellation program to demonstrate that 
their systems will be at least as safe as Ares/Orion. Alternatively, do they think it 
would it be acceptable to reduce the required level of crew safety on commercially 
provided crew transport services used to transport U.S. astronauts much below 
what looks to be achievable in the Constellation program? 

In addition, we need to hear our witnesses’ views on whether the timetable sug- 
gested for the availability of commercial crew transport services is realistic or not. 

That is, when one takes into account all of the steps — not just those that are ex- 
plicitly safety-related — that will need to be taken before the first NASA astronaut 
can take a ride to the ISS on an operational commercial crew vehicle, do our wit- 
nesses believe that such vehicles will be available in time to meet a significant frac- 
tion of NASA’s ISS crew transfer and crew rescue needs prior to 2020 or not? Simi- 
larly, given those required steps, do our witnesses believe that would-be commercial 
crew transport services providers will be able to garner sufficient revenues from 
non-NASA passenger transport services to remain viable over that same time period 
or not? 

It will be difficult to make reasoned judgments about the wisdom of investing sig- 
nificant taxpayer dollars in would-be commercial providers or of altering Congress’s 
commitment to the existing Constellation program in the absence of clear answers 
to those questions. 

Finally, what do our witnesses consider to be the most important safety-related 
issues that will need to be addressed as we make our decisions on the future of 
NASA’s human space flight and exploration program. 

And, at the end of the day, what will Congress need to do to have the assurance 
that we have done all we could to ensure the safety of the nation’s future human 
space flight activities? That is not a hypothetical question. It is fundamental to ful- 
filling our responsibilities as Members of Congress. With so much for this sub- 
committee to consider, I am comforted by the realization that we have a very distin- 
guished panel who can speak with conviction and knowledge about the safety issues 
that will need to be considered. 

I want to welcome each of you to today’s hearing. All of us who are passionate 
about space, whether in the private sector or the public sector, want the best pos- 
sible future for our nation in its space endeavors. I hope that this morning’s hearing 
will help us chart a productive and responsible path forward. 

Finally, I would be remiss if I did not acknowledge the unique contributions of 
one of our witnesses to the advancement of safety in human space flight. I want 
to welcome each of you to today’s hearing. Lt. Gen. Thomas P. Stafford, a veteran 
of the Gemini, Apollo, Apollo-Soyuz, Shuttle Return-to-Flight, and countless other 
space flight efforts, can speak with authority on safety issues — he has lived them. 
He is a true national hero. 

So in closing, I know that my colleagues join me in saying that we owe Gen. Staf- 
ford and the other pioneers of human space flight a debt of gratitude. Without their 
efforts — and bravery — NASA would not have made the safety advances that it has. 

Chairwoman Giffords. The Chair now recognizes Mr. Olson for 
his opening statement. 

Mr. Olson. Madam Chairwoman, I would like to yield to the 
ranking member of our full Committee if he is ready to make his 
statement at this time. 
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Mr. Hall. I don’t know how ready I am but I will take a shot 
at it. 

I really enjoyed, Madam Chairman, your speech and I agree with 
everything you have said. You are in an unusual position to know 
what you are talking about and have more than just a passing in- 
terest and more than a committee chairman’s interest in the safety 
that we are going to talk about today, and I want to thank you for 
allowing me to make the statement and for holding this hearing. 
It is one of the topics that I think I am most passionate about and 
that is the safety of our crews. It simply has to be at the heart of 
everything NASA does in space. 

Also, I want to sincerely thank all of today’s witnesses for taking 
the time and effort. I know it takes time. You prepared yourself 
back during your lifetime for this presentation to us and you are 
the very type of citizen that comes here that gives us information 
from which we glean the ingredients that go into the bills, and we 
know it takes your time. Your time is valuable and you didn’t suf- 
fer to get here but you paid the price to get here. We are very hon- 
ored to have each one of you. I want to sincerely thank all of you 
for taking the time and effort. 

I especially want to welcome a friend of mine here and have the 
liberty of saying a word or so about Gen. Tom Stafford. He is a 
good friend. He is a national hero. I have relied on his advice for 
many years. He is the kind of guy that I call and get him out of 
the garden or wherever he is, the library, wherever he may be, but 
I have called on him for a lot of information on many occasions and 
we have exchanged personal letters through the years, most re- 
cently when he chaired the Stafford-Covey Return to Flight Task 
Force established to ensure that the Columbia Accident Investiga- 
tion Board’s recommendations were carried out. 

And we have a lot of important issues to cover today. The Colum- 
bia Accident Board gave NASA many safety recommendations and 
principles to follow in the design of future launch vehicles. In May 
of 2004, after carefully reviewing the findings, the Astronaut Office 
published their position on the safety of future launch systems. 
One recommendation was to include a crew escape system module 
as part of any new launch vehicle. In the NASA authorization bill 
of 2005, many of us worked together to ensure that such a system 
was part of NASA’s plans for the next human exploration vehicle, 
and I know we all will continue to insist that this remains the case. 

Much of what I say today is in a piece in Monday’s edition of 
Space News. Madam Chair, I would like to ask unanimous consent 
to include a copy of the May 4, 2004, Astronaut Office position on 
future launch system safety and throw in a copy of my November 
30th Space News editorial into the record. 

[The information follows:] 
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Astronaut Office Position on Future Launch System Safety 


Executive Summary 

The Columbia accidail, the selection of a booster for the Orbital Space Plane (OSP), and 
NASA's recently renewed interest in exploring beyond low Earth orbit have led the Astronaut 
OfSce to reexamine its views on launch system safety. Although flying in space will always 
involve some measure of risk, h is our consensus that an order-of-magnitude reduction in the risk 
of loss of human life during ascent, compared to the Space Shuttle, is both achievable with 
current technology and consistent with NASA's focus on steadily improving rocket reliability, 
and should therefore represent a minimum safety benchmark for funve systems. To reach that 
target, the Astronaut Office offeis the following reco mm endations. 

The Astronaut OlSoe recommends that the next human-rated launch system add abort or escape 
systems to a booster with ascent reliability at least as high as the Space Shuttle's, yielding a 
predicted prohabilhy of 0.999 or better for crew survival during ascent The system should be 
designed to achieve or exceed its rdiabilily tequitemem with 9SH confidence. 

The Astronaut Office fccommends that new human-rated launch vehicle programs follow 
guidelines, such as those given in the Columbia Accident Investigation Board (CAIB) Report 
arrd NASA's Human Rating Requirements (NPG 870S), for safety-conscious management 
requirements dcfliiitian. concept development and design selection. 

The Astronaut Office recommends that NASA specify and maintain a set of formal, 
standardued, complete methods and processes to be used in predicting the tclialnlity of human- 
rated spacecraft, a^ identify or create an independent body to verify those analyses. 

The Astronaut OfTice recommends that the test program for the next human-rated launch system 
demonstrate hs reliability through vigorous ground and flight testing of components and systems. 
The value of each lest should be leveraged by proving a safe envelope larger than that expected 
during operations and by using flight data to validate system reliability models. After 
completion of the formal test program, the vigilance applied during testing to data gathering, 
analysis, and flight constraints should coatinue to be applied during opentioiis. Reliability 
should be continuously reassessed. 

The Astronaut Office believes that the next bumon-rated spococraft must include a robust fiiU- 
envelotK abort or escape system. The safety of the overall system depends on the reliability of 
both the booster and the abort or escape system. As with the rocket itself the abort or escape 
system reliability must be proven through flight testing. 
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L Imraduction 

Flying in ijiaoe will alwiys involvt seme measutt of risk. Astronads are willing to aocepl 
tigniricaol riiks to furdier the cause of qiaoe explomioo. Nevertheless, the Asinmaait Oflke 
believes that future spacecraft can and should be much safer than present systems. 

The CAlB, In its 2003 leport, advised NASA to adopt flight safety as its “ovenridiiig priority." 

In hearings followiag the loss of Columbia, memben of Congress agreed with that 
recommendation, emphasirittg that improved safety is essemial to maintaining NASA’s 
cicdibUity with both the public and Congress. 

Shortly after the Colombia acckknl, the OSP Program released its Level I Requiicments and 
Operational Concepts. These slated in part that, "The vehicle(t) shall mitially launch on an 
(expendable launch vehicle] ELV," referring to the Atlas V and Delu IV ELVs. These rockets 
belong to a family of vehicles with a success rale of 0.97$. Even with extensive modifications, 
they may never achieve a meaningfully higher success tale.' For ctanparison. the success rale of 
the Space Shunle if viewed solely as a launch vehicle is 0.991 (oik ascent failure in 113 flights, 
courting the Columbia accident as an entry failure because it achieved a safe orbit after launch). 

Although history has shown that deadly acerdents can occur during any phase of flight, aacenl 
still poses a major risk 10 human Ufi^ If we wish to send exploaers into space on increasingly 
ambitious missions, we roust tint solve the problem of puntng huanans into orbit mote safely 
than is possible with our current launch sysKms. 

The Columbia acetdent, the selectioo of a boaster for the OSP. and NASA's recently renewed 
interest in exploring beyond low Earth orbit have led the Astronaut Office to lecxomine Iti views 
on launch system safety. Although flying bi space will always involve some measure of risk, it 
is our consensus that an ordcr-of-mogniiude rednetion in the risk of lorn of human life during 
ascent, compared to the Space Shuttle, b both achievable with current technology and consistent 
with NASA's focus on steadily improving racket idiability, and should ibetefote tepse sen l a 
minimum saicty benchmaik for future systems. 

Q. Flight Safely and Reliability 

Flight safely means protecting the lives ofibe ciew as the lop priority, above cost, manpower, 
letnability. adherence to schedule, and all other comidera tiu n s . given that we ore undertaking a 
dangerous mission and that our resources are finite- 

Fligbt safety U not just a philosophical viewpoinL h b also a measurable quasitity: the 
ttliability of the systems i^on which the crew’s safety depends. But according to reliability 
theoiy,^ it b not possibie to measure a vdiicle's reliability exactly. Instead, the probability of a 
safe fli^ must estimated using malbemalicsd models, flight history, or a combtnolioii of 
both. 

In Ihb paper, we define aseem as the time from crew airival st the launch psal until msatian into 
an Dibit ttet is sale for at least 24 hours, or. In cases where luch an orbit is not reached, until 



26 


CB-04-(M4 4 

crew lecovety b> rcKue forcei oa Eailh. We wiU use three statistical definitioa of ascent 
leliibilhy: predicted retiabiliiy, success rate, and demoRstrated reliability. 

Predicted reliability is an csiinute of reliability, made in the absotce of sufileicnt flight data, 
Ihtotigh the use of probabilistic risk assessmem or other trustworthy modeling techniques. Its 
accuracy is limited because it relics on an incompictc understanding of the machine and its 
envi ronm e n t and usually takes into account only known lailBtc modes. As flight <tM« becomes 
available, it can be included in the models to improve the accuracy of tdiabUity predictions. 

A rocket's success rate is the number of tunes it has safely readied orbit, divided by tbe number 
of limes it has been laun ched . For piloted missioas, we count a flight reaching an incotTcct but 
safe orbit as a success, sinoe it docs not threaten the lives of the crew even if the misskm is lost 
Success rate is not the same as idiafaility. But with enough launches the success rate will 
gradually become an accurate estimate of reliability. 

Dcinonstrm ^ is an estimate of tdiabUity based on the success tale, sritb allowances 

for staUstkal uncertainly. 

Even a "mature" laundi system with a long fligbt hisuay haa signilicani unoeitainly in in 
reliability. To reflect that uncertainty, every reliability estimite roust include a ecmfideiaic level. 
wbkh allows for the possibility that a rocket's modeled performance or existing safely record, 
because ofaruUytical errors or random chance, docs not reflect the truth. A standard confidence 
level is 9SH, meaning that there is only a SH chance that the system's real reliability is outside 
Ihe bounds of the estimate.’ A lower confidence level means a greater probability l^ the actual 
value of reliability fidls outside the range of tbe cstiroale. For rockets carrying people, where 
low tdiabUity is of greatest concern, a reduced confidoicc Icvd corresponds to a greater 
likelibood of unrecognized danger. 

DemonsliBted reliability estimates at 9S% confidence will be very low for new systems when the 
number of flights is small This is because even an untrustworthy system can succeed a few 
tinies by landom chance. It is just this kind of chance that the oonfldcnce Icvd is intended to 
compensate for. (Confidence levels are less unponant if data from hundreds or thousands of 
fligto is available to reduce the staUstical uncertainty in Ihe reliability estimate to an acceptably 
low value. Such a rich test hiaiocy Is cliaractcfisticofairplanc programs, but not of launch 
systems in Ihe past or near finuc.) Note that tbe Sfaunic was declared "operational" at a time 
when Its demonstrated rdisbitity could only be said to be better Ihui 0.473 with 95% confidence. 

We now apply these concepts to the reliability of future human-rated laiaich systems. As we 
discuss below, adding abort or escape systems to a booster with an ascent rduibiliiy at least as 
high as the Space Shuttle's oould yield a fimire launch system with an order-of-magnitude less 
ascent risk than Shuttle. Such a system, which the Astronaut Office believes is feasible using 
p resen t technology and production ptocesaes, would answer Ihe call for meaningfully impfoved 
flight safety as called for Iqr Congresi, the CAIB,’ and the Asnunaul Office.’ It is sin consistem 
with Ihe ascent risk tequiremenl accepted by Ihe former OSP Program This new safety 
benchmark co rresponds to a predicted probability of 0.999 or belter for crew survival during 
asoenl If flown enough tiroes, it should demomarsie the same reliability. To ensure that a new 
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system achieves its safety rc()uircinent, h should be designed to meet or exceed that value with 
the standard 95% confidence. 

The AstroBant Office recommends that the next human-rated lauBCh system add abort or 
escape systenu to a booster with ascent reUabiiity at least as high as the Space Shuttle’s, 
yielding a predicted probabiUty of 0.999 or better for crew snr^val during ascent. The 
system should be designed to achieve or exceed its reliability requirement with 95% 
confidence. 

in. Mnnagiiig and Oesigning for Flight Safety 

Designing significantly safer space vehicles requires adopting flight safety as the overarching 
figure of merit aisd unplementing measures that have been shown to minimize risk, including 
those outlined in the CAS Report' Practices of safety-conscious flight programs include the 
following: Systems should be assumed to be unsafe until proven otherwise. Waivers should not 
be accepted without rigorous technical justificatioo. Expert advice fiom outside the organization 
should be sought and heeded to assess program management, vehicle design, construction, lest 
and operaiiciiu. Safety must never be compromisod by cost scbcdule, or other considerations. 
The concepts of programmatic risk (to cost and schedule) and operational risk (to life and 
property) must be carefully separaied- 

Requiremenls. especially safely requirements, fat a human-rited launch vehicle must be spedfle, 
unambiguous, ani verifiable. New programs must follow NASA’s Human Rating Requirements 
(NPO S70S), protect tboae rcquhcmeins fiom unnecessary ’’tailoring,” weakening, and 
abandonment and ensure that they arc met 

Thorough, objective trade studies must be done to identify the design that best meets the 
fcquireroenis (Htoices of technology and architecture should be guided by flight safety over 
cost schedule, or any other priority. 

New programs should choose conservative, simple designs, which arc usually safer. They 
should adopt proven design standards and analytical approaches. Designs should preserve 
healthy margins and factors of safety, and employ redundancy in critical systems. Human rating 
should be dmigned in, not appended on. WeU-undentood, higb-quality, Mgh-tcliability 
materials, components, and architectures should be selected. Hardware and software should be 
designed to degrade gracefiilly rather than fidl catastrophically. The system must provide human 
insighl into subsystems and allow human intervention duriitg failures. Future improvements and 
siqiplementory backup systems must not be assumed to adequately substitute for a good basic 
design. 

The Aitronanl Office recommends that new human-rated launch vehkic protcranu fellow 
guideliacs, such as those given In the CAIB Report nnd NASA’s Human Rating 
Rcqoiremealt (NPG 8705), for safety-conscious management, requirements defiaitlon, 
concept development, and design scicetioo. 
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rv. Predklcd Relial>Uit> ofNew Desipu 

History has shown dm rocket des'elopers may exagsenue the merits of their systems. An early 
claim for the Sfwce Shuttle*! probability of crew sur%‘ivBl was 0.99999, thousands of times safer 
than later demonstrated.* Because safety is the most important cooskferation for bumait-rated 
space vehicles, predicted reliability must be quantitativdy understood at all stages of design. 

A long record of successful flights is the best way to demonstrate flight safety. When a new 
system |wlf« enough flight history to support reliability claitiu, test results are the next best 
^ice. During early devetopment there is no hardware to test, so reliability must be predicted 
using state-of-the-art modeling techniques such as probabilistic risk assessmertt. t'nfortimalely. 
predicted reliability figures can be suspect, even if they ate produced using modem, standardized 
techniques. The system developer owns the proprietary data upon which the models arc based 
and ihm dam ate rarely shared for independent verification. Complex teliabilily models contain 
nnroetous parameters t^ are urteettain or subject to interpretatiorL (Models of this kiod ate 
notorioin for being able to produce any answer the modeler wants to obtain.) Some reliability 
models treat only component failures, neglecting human e r ror s in processing and operalions. 
Finally, most reliability models treat only known modes of Csiluie snd may miss significant risks 
from unforeseen causes, especially uiunlended interactions between parts of a complex system 
(such as foam fiom the Shuttle's external tank strikirtg the wing leading edge). 

Creaier confidence in ptedicied reliabilily numbers can be tcaluied in several ways. One is to 
specify standard modeUng methods for ptodudng them. Another is to validate them through 
independent third-patty verification using separately developed models. It may also be possible 
to truth-ten teliabilily models against compuahle existing systems with more precisely known 
reliabilily. Many nx^s can be made mote realistic by expaurding tbem to include human errors 
in processing and operations os well as the possibility of unanticipated failure modes. 

Verification of this kind is difficult to obtain, but the powerful influence of model reliability 
estimates in deletmining the ultimate safety of the design (and hence the ultimate success of the 
program) demands thorough validalioD of the models and their results. 

The Astronaut Office treonmeads that NASA ipcciiy aad malatain a set of fonaal, 
flaadardiztd. conplrle methods tad procesacs to be used ia prcdictiBg the rcliabiUty of 
haman-rated spacecraft, and identify or create an iadepeadrat body to verify those 

anafyscs. 

V. Vehfying Flight Safety through Testing and Operations 

Once hardware is built, its reliability con be accurately assessed, first through testing and later 
during open ti om. Because testing will expose the vulnerabilities in a system more accurately 
and more realistically than tnaiysis, vigorous testing to qualify all levels of the system, including 
individuai and integrated c omponents, on the grouial and in flight is essential. Flight testing 
should pro g re s sively expand the envelope, following proven aviotioa practices. Test flights 
should identify the systra's weakest ports and exercise them most strenuously. The fli^t test 
program must demonstrale tfaal the system's reliability meets the requirements, either Ihrougb the 



29 


CB-0MM4 


7 


sheer number of lesU, through proving ■ safe envelope much huger than expected during 
opemiotu. through validation of system models, or through a combination of all three. 

The foimal test program for a new commercial or military airplane involves huitdreds of test 
flights. The \atgc number of tests yields complelc. precise understanding of the hardware and its 
performance. Such a comprehensive test prograro for a new spacocraft is likely to be 
prohibitively expensive. It is therefore expected that the next new hrmran-rated spacecrafl will 
be much less well utsderstood than the rrext new milttary airplane when it goes into operation. 
Accordingly, even after completiao of a formal lest program, the spacecraft should still be 
operated as though it were an experimental vehicle. Operatioaal practices associated with this 
paradigm include ooUectian. vchivtng. and timely analysis of daU on the health and 
pcrfonnance of all systems. All atxrmalies should be recorded, tracked, and aggressively 
invcstigalcd. Unresolved anomalies should be considered constraints to flight. The system's 
reliability estiniaies and their underlying models must be continuously refined to reflm the 
vehicle's actual performance. An aneilUry advantage of such an operational paradigm is that it 
will formally idmtify and capture ideas that will be useful in further improving the safety of 
current and future Immch vehicles. 

The Astroasal Oflke rtcommeuds that the lest prograai for the next hotnaa-raled launch 
lyslem demoaitratc itt rellabiUly Ifaroiigh vigorous ground aad flight testing of 
coBipoaeats aad systems. The value of each letl should be leveraged by proving a safe 
envelope larger than that expected during operalioBs and by nsiiig flight data to validatr 
lyilcm rcUabilily models. After completien of the formal lest program, the vlgHaocc 
applied daring Icstiag to data gathering, analysis, aad flight coaslralBls should coBlinae to 
be applied during operations. Reliability shoaM be coatiaBoasly reassessed. 

VI. Improving Ascent Safety with Aboit and Escape Systems 

The current benchmark for ascent leliabdity ia the Space Shuttle's success tale of 0.991. 

Existing commercial rockets have lower succesa rates.' Given the low idiabiUty of even the 
safest existing rockets, meeting the Astronaut Office's goal of an ordcr-of-magnitude reduction 
in the risk of spoce flight will require making the risk of losii^ the crew much smaller than the 
risk of losing the booster . This can be achieved by adding abort and escape systems. The 
"Astronaut Office Position on Crew Survivability During Ascent and Eittry'^ defines an "abort" 
as a flulurc case where the crew stays in the part of the spacecraft normally designed to carry 
them during entry, as with an Apollo-siyle tractor rocket "Escape" means that the crew leaves 
the crew compartment after the failure, as with an escape pod. Section seats, or bailout 
capability. A successful abort or escape is one in which tte crew survives abort or escape 
initiation, separation fiom the booster, descent and landing, awaiting rescue forces, and being 
securely recovered by those forces. All elements involved in abort or escape flight. landing, 
post-landing survival, and rescue efforts are considered part of the abort or escape system. 
Poftiofu of the flight trajectory where abort and escape are imposaible are called "black rones." 
Because the overall safely of the system depends so strongly on the abort or escape system, black 
rones greatly increase overall flig^ risk. Ihey should therefore be roininrixed to the fullest 
extent possible. The safest design will include a "full envelope* abort or escape system, which 
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provide* llie crew with ■ ■ecanduy wiy to nrvive vehicle hulutci it *11 points in the flight 
pcoflle. 

Abon and escape sysicnu must operate very quickly and precisely, may need to withstand the 
detonotioa of hundreds of tons of explosive propellams in close proximity, must perform across m 
wide and never fully understood range of ooaditioni, and may d^ the crew compulment onto 
inhoapioble locations on the Eanh's surface when the crew might wail days to be rescued. The 
reliability of an abort or escape system must include its ability to save the crew from all credible 
failures at all times during ascent, and its ability to protect thm after separation from the rocket 
until recovery by rescue forces. 

Abort and escape systems can never be perfectly relirdtle. Historically, about IJK of rocket 
accidents have involted catastropluc suck failures occurring with to little warning that notional 
abon or escape syslems likely could not have saved a crew on board' Considering the 
cballertgcs of teparaiioo alone, abort or escape system reliability figures higher than about 0.17 
may be difflcuh to adiicve without tpecific^y designing the booster to fail only in benign ways. 
Even if separation from the fmling booster it successful, abort descents, landings, and rescue 
tcenanot ate more difltcuit to survive than their nominal counterparts, implying an overall abort 
or eacape tystem reliability even lower than 0.17, Because of tbc abort or trsctpe system's vital 
role in pcolecting tbc lives of the crew, its reliability estimates must be comprehensive and 
realistic during the design phase, and supported by rigorous flight-lestiog a^ hardware exists. 

The ubie below shows how the rate of fatal accidents depends on the reliabilities of the booster 
and the abon or escape system. To clearly illustrate the effect of both parameters, we convert 
ofiiiiBiy reliability figures (e.g., 0.999) to expected numbers of fatal accidents per 1 ,000 
launches. Presented in this formal, the Space Shuttle's 0.991 ascent success rale becomes 9 final 
accidents per I.OOOlaunches, snd the Astronaut Office safety tsrget of 0.999 bone fatal accidcM 
per 1,000 launches. In the tiAle, green denotes combinatiaos of booster snd abort system 
rehthilities llml meet that target Systems with two or (ewer fatal accidents per 1,000 launches 
are shown in yellow. 

Table I. Fatal ascent accidents per 1,000 launches, for diflereni values of booster and abort or 
escape system reliability. 

Abort or Escape 

Booster System Reliability 

Reliability 
0.99i 
0.990 
0.980 
0.970 
0.960 
0.950 

The ubic tfaowt that if the abort or escape system has a reliability of 0.900 (chosen as ■ 
reasonable upper limit, following the discussion above and presuming a booster designed not to 


0 *00 0.850 0.900 0.950 
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fail ouaslrophkalty. so ihM llic aboa or escape sysien teliabtlily can exceed 0.S7), the Adroniut 
Office taiety tatgei of I fatal accident per 1,000 l a un c hes can be rcacbod only by selecting a 
booster with a reliability ofO.990 or belter. Existing coaunodal rockets have deroonsnaled 
reliabilities near 0.9SO with 95H coolideiKe ' The Space Sbuitle, if viewed solely as a launch 
vehicle, has a Mgh success rale of 0.991, but applying the standard 95% confidence level putt its 
demonstrated reliability near 0.960. A new booeaer design that avoids complex, fragile, aisi 
unproven lechnologiea and arehitecturcs while embracing the more extensive testing, design 
margiai. process control, instnrmenucian, operator irttervention, and fault toletance 
characteristic of current humon-ralcd fii^ hardware might achieve or exceed 0.990 reliability 
with high confidence 

The Astroaaol Office believes that the IMSI beaua-ralcd spacecraft most lactade a rabesl 
faU-envelope abort or escape system. The safely of the overall syetem depende oa the 
reliabUlly of both the booster and the abort or escape system. As with the rocket Msclf, the 
abort or cscope system reUohiHty matt be provea Ihroogh fHgfat lestiag. 

VU. Launching Humans on Allas V and Delta IV Boosten 

The possibility of using the cuneni Allas V and Delta IV rockets to launch a new, piloted 
spacecrafl has led the Astronaut Office to look closely at the crew safety implications of this 
optiofL 


• According to the OSP-ELV Human Flight Safely Ceitification Study Team Report,' the 
Allas V and Della IV rockets do not meet many of the NASA safety standards spectfied 
or refereocod In NPO 8705, the Human Rating Requiicments. Mi^or changes needed to 
bring the vehicles into compliance would include at least: adding failure tolerance for 
critical systems, redesigning for greater structural safely (acton (hunun-ralcd spacecraft 
use 1.4; Atlas V snd Ddts IV rockets use 1.25), adding fauh det^on and tsoliikm 
frnctiooi, making the range desiruci philoaophy compalibie with maxiiman crew 
survivability, wiring frir insight sod intervention by Ihc crew and ground conlinL, 
performing the detailed risk analyses needed for human rating, tupplcroenting process 
eesitrols in all phases of production, md flight testing to hunan rating standards. 

• The Allas V mxl Delta IV boosten wen boill to be cost-cflectivc for their mannfiicturen. 
insuien, and customers, coosiderisrg the value of the non-humon payloads they wen 
designed to carry. Although cost-efTeetiveoess includes lefiahtlity considenlioas, safely 
is not the prime driver for salcllile laimchcs The expense of human raring these existing 
rockets by adding design margins, cedundsocy, instnonentation. process control, 
command capabilily. aitd testing, might make them uneconomical for their original 
missian and could potentially be as costly as buildiiig a new human-niled booster. 

• The reliability of Atlas V and Delu IV rockets it nor precisely knovm because they era 
too new. Given insufficient (14^ data, one melliod for predicting reliability is to assume 
that a new system is about as rriiable as a similar, existing system. The OSP-ELV 
Human Flight Safety Certification Study Team' used the fii^t record of Allas. Doha, and 
Titan rockets developed under U.S. Goveimncm camracts ood launched siiKe 1990 to 
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predict the retiability of the Allas V and Della IV. These rackets hove been launched 236 
limes and reached safe orbiti 230 limes. The mulling reliabilily estimate is 0.9S0 or 
bellet wilh 95% confidence. The boosters' potentially low reliability would place 
excessive burden on abort mechanisms lo save the crew. The abon or escape system 
would need a rdiability near 0.9S0 for the complete launch system to meet the Astronaut 
Office crew survivability target. Proposed abort and escape systems were Judged to be 
incapable of rescuing the crew from stack detonations occurring with little or no 
warning. ' These faitum occur oflen enough lo prevent even a high-reliability abort or 
escape system from meeting its safety renuittntenl ' 

• Allas V and Della IV boosters fly to orbit on highly lofted trajectories because of second- 
stage performance limitations and range destruct line-of-sight ie<|uircmcnls. If a piloted 
spacecraft had to abort near the apex of such a tnyectory, it would hit the atmosphere at a 
high speed and a sleep angle. The resulting heat and oocelenuioa loads on the crew 
compoitment would be severe and possibly not survivabte.’ 

In summary, the Allas V and Delta IV rockets should be measured against a set of ooncicte, 
specific, verifiable requiremeius for carrying humans before being selected for itui purpose. A 
safer launch opiioa might be identified Iq' objectively comparing the advamagei and dmwhacks 
of a range of existing, modified, and new launch systems rriative to those requirements. 

Vin. Summary and Conclusion 

If we wish to tend exploren into space on increasingly ambitious missions, we must first wive 
the problem of getting hununs into orbit more safely than is possible with our current launch 
sysumo. 

The Astronaut Office believes that on order-of-nugnitude reduction in the risk of loss of huiium 
life during ascent, compared lo the Space Shuttle, is both achievable with current technology and 
consistent wilh NASA's focus on steadily improving rocket reliability, and should therefore 
rcpRfcnt a minimum safety beiKhmork for future systems. This corresponds to a pndicled 
Bsceot reiiability of at least 0.999. To ensure that a new system will acMevo or surpoa its safety 
requiremenl. it should be designed and tested to do so with a statistical confidence level of 95%. 

Tough safety requirements esn be met in pan by adopting (he best pnetioes for Ifae management, 
design, test, snd operation of risky technology as given in the CAIB Report in NASA's Human 
Rating Requirements (NPO t705X and in conuncrciai and military aviation- 

The burden of proving tfwt a vehicle is safe falls on the mathematical models, lesix, and 
operational histoiy that measure the system’s reliability. Accordingly, the Astronaut Office 
recommends that NASA specify snd moinuun a set of formal, standardized m^bods and 
processes to be used in predicting the teUability of bumao-raled s p a c ecraft, and Identily or create 
an independent body lo verify those analyses. We funhcr recommend thil the test program for 
the next human-talcd launch system demonstrate its relisbility through vigorous ground and 
flight testing of c omp o nenB and systems. The value of each lest should be leveraged by proving 
a safe envelope larger lhao that expecled during opentjons and by using flight data to validate 
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tystcni leliAbility tnodeli. After completion of the fomul test program, the vigitwee applied 
during testing to data gathering, analysis, and flight coitatrainu should continue to be applied 
during operations. Rdiafaility should be continuously reassessed. 

The Astronaut Oflke believes that the next human-rated spacecraft muss include a robust full- 
envelope abort or escape system. The reliability of both the rocket and the abort or escape 
system are limited and must be proven through flight-testing. 

It is our hope that NASA will adopt the principles outlined in ibis papa to design, taiild. test, and 
Oy a new vdiicle that is much safa than its existing counterparts. Such a vehicle will help 
ensure that our nation retains the capability for human access to space. 

CB-04-044 12 
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Don’t Let U.S. Lose Leadership in Space 

By Rqt. Ralph Hall (R-Tcxaa) 


There is a lot at stake for the future of human spaceflight. Forty years agi> America 
become the untiisputal leader in space when we successfully landed on the Moon. This 
feat inspired a generation of scientists and engineers who helped solidify America's 
position tts the world's leader in high-tech innovation. Today, America's space agency 
faces some difficult decisions. NASA will soon retire the Space Shuttle, hut has yet to 
complete the next generation vehicle. The gap will result in reliance on Russia to ferry 
our astronauts to and from the International Space Station I ISS), a situation that raises a 
host of coneems. 


Without our own vehicle to access the ISS, America risks losing its position of leadership 
in space. The ISS represents the culmination of the greatest engineering project perhaps 
in human history, and the U.S. has led in this effort. The gap in spaceflight capability 
muif be minimi/:cd. and we must accelerate development of the follow -on system. 

However, before evaluating the best way to move forward, perhaps we should first 
reflect on how we've arrived in this position. 

In the aftermath of the Columbia tragedy, America did some soul-searching. The 
Columbia Accident Investigation Board (CAIBf concluded that there was a "failure of 
national leaderdiip" that contributed to the accident and to NASA's inability to finish 
earlier programs deemed as hoped-for replacements for the Space Shuttle. The CAIB 
encouraged Congress and the White House to clarify our goals in space. I was 
encouraged in early 20(>4 when the Administration unveiled the Vision for Space 
Exploration, giving the Space Agency clear direction and measurable goals. NASA was 
directed to complete the ISS and to develop a capability to fly beyond low Earth orbit, 
allowing us to return to the Moon and eventually pursue a "flexible path" of exploration 
through the solar system. Giving NASA a clearly defined destination and the clearly 
defined design requirements that go with it will help ensure long-term success. 

The CAIB also acknowledged that human spaceflight is a risky endeavor and said that 
*1hc design of the system should give overriding priority to crew safety, rather than trade 
safety against other performance criteria, such as low cost and reusability." I couldn't 
agree more that crew safety must be a lop priority when developing any new launch 
system. 

After the Vision was annouiKed. Congress held numerous hearings to review the 
Constellation program proposed by NASA, and in the end agreed with the goals and 
urchileclurc of the plan. It is important to note that both the 200S and 2008 NASA 
Authorization Acts reflect broad, bipartisan, bicameral support from Congress for the 
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clcmcnls of lhal onjcinal vision. But unliinunatcly the funding necessurv to fully achieve 
this vision, along with NASA's many other missions, has been inadc«]uatc I have said 
many times heforc that for too long NAS.A has been asked to do too much, without the 
proper funding 1'his tack of funding has led us to where we are today. 

Congress has a strong desire and need to minimi/c the gap. Independent American 
access to the ISS is a strategically important national imperative. The best way to achieve 
this IS to accelerate dev elopment of the Onon Crew Rxplorution Vehicle and Ares I Crew 
Launch Vehicle. Significant progress has already been made in developing these 
capabilities, and to abamlon that progress would he a step backward. In support of that 
position, lo-st year Congress authonred an additional SI billion ubsive the President's FY 
’(XW NASA budget request to accelerate the development of the Constellation system 

Another proposal that some Members of Congress believe could help NASA during tlie 
gap IS to foster a commercial cargo delivery serv ice to the ISS. However, it is important 
to note that Congress did not endorse a commercial crew option as an appnipnate 
Milution for the I '.S. to meet our responsibilities and commitments to our international 
partners A commercial crew- capability stmply could not be properly evaluated and 
ready in time to safely fly our a.stninauts dunng the gap The c-ommcrcial erew 
demonstration miliatives in ibc N.ASA Authori/ation Act were not intended to supplant 
development of Ares I and t )non. As I said, astninaut safety must be the top pnonty. 

After the Space Shuttle is retired, N.ASA will still be required to pmvidc crew rescue 
capabilities for ourselves and our international partners fnim the ISS. The .Ares I launch 
vehicle and ihc (>non capsule arc hang designed with these goals in mind. 

The Obama .Administration should currently be putting the llmshing touches on the fiscal 
year 201 1 budget that will be submitted to Congress early next year. I urge the President 
to request adequate funds so that NAS.A can maintain its leadership role in space. 

Without this leadership it will he difficult for Congress to appropriate the necessary 
funding W'c must he mindful of our federal budget and direct ta.xpaycr dollars to 
priorities that generate the greatest return on our investment. Our space pnvgram has 
possibly contributed as much or more than any civilian government program to sccunng 
America's technological and economic leadership in the world. The plan Congress 
authori/cd is one w orthy of a great natiim. 

Chairwoman Giffords. Without objection. 

Mr. Hall. And with that, I want to just say another word or so 
about Tom Stafford. He graduated from the U.S. Naval Academy 
ten years after Sam Rayburn came to my breakfast table to talk 
to my mother to tell her why he couldn’t appoint me to the Naval 
Academy. They were in school together at Mayo College there. It 
is now Texas A&M at Commerce, but they were friends forever. 
She was part of the first team to ever get Sam Rayburn to run for 
office. She wanted him to appoint me to the Naval Academy. He 
said there are just four reasons and all four reasons are his grades. 
Later, Madam Chairman, that came home to me because they ran 
an article in the paper when I was running for reelection for judge 
one time that I had made four F’s and a D one time and my dad 
had punished me for spending too much time on one subject. That 
wasn’t very good. But Tom has also flown two Gemini missions. He 
is the first Gemini mission, and he piloted the first rendezvous in 
space. He is cited by the Guinness Book of World Records for the 
highest speed ever obtained by a man, or a woman, I am sure, 
24,791 miles per hour during the reentry of Apollo 10. He was in- 
strumental in our early space missions with the Russians. He 
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logged over 507 hours in space and flew four different types of 
spacecrafts. He obtained the rank of three-star general and he 
served as a defense advisor to one of the great Presidents of the 
century, President Ronald Reagan. Tom and you other five gentle- 
men, we thank all of you for what you are doing and your presence 
here today. 

I yield back. Thank you. Madam Chairman. 

[The prepared statement of Mr. Hall follows:] 

Prepared Statement of Representative Ralph M. Hall 

Madame Chair I want to thank you for recognizing me to make a statement, and 
for holding today’s hearing on ensuring the safety of human space flight in future 
space transportation systems. It is one of the topics I am most passionate about. 
Safety of our crews simply must be at the heart of everything NASA does in space. 

I also want to sincerely thank all of today’s witnesses for taking the time and ef- 
fort to share their unique and valuable wisdom and expertise with us. I especially 
want to welcome General Tom Stafford. Tom is a good friend and a real national 
hero. I have relied on Tom’s advice for many years, most recently when he chaired 
the Stafford-Covey Return to Flight Task Group that was established to ensure the 
Columbia Accident Investigation Board’s recommendations were carried out. 

We have a lot of very important issues to cover today so I will be brief. 

The Columbia accident board gave NASA many safety recommendations and prin- 
ciples to follow in the design of future launch vehicles. In May 2004, after carefully 
reviewing the findings, the Astronaut office published their position on the safety 
of future launch systems. One recommendation was to include a crew escape system 
as part of any new launch vehicles. In the NASA Authorization Bill of 2005, I en- 
sured that such a system was part of NASA’s plans for the next human exploration 
vehicle, and I will continue to insist that this remains the case. 

Much of what I would say today is in my editorial piece in Monday’s edition of 
Space News. Madame Chair I’d like to ask unanimous consent to include a copy of 
the May 4, 2004 Astronaut Office Position on Future Launch System Safety; and 
a copy of my November 30, 2009 Space News editorial into the record. 

With that, I look forward to a very productive hearing and yield back my time. 

Chairwoman Giffords. Thank you, Mr. Hall. 

If there are other members who wish to submit additional open- 
ing statements, your statements will be added to the record at this 
point. 

Mr. Olson. Madam Chairwoman? 

Chairwoman Giffords. Yes. 

Mr. Olson. May I make an opening statement? 

Chairwoman Giffords. Sure. 

Mr. Olson. Thank you very much. I appreciate that, and I know 
part of this is my fault for getting the ranking member in here. 

Madam Chairwoman, thank you for calling this morning’s hear- 
ing on a topic of paramount importance to the future of our human 
spaceflight program. The issue of safety is really the starting point 
from which all discussions about the course and purpose of our Na- 
tion’s human spaceflight program should begin. I am certain we 
would have a line of people out the door to test-drive the new rock- 
et. That pioneering spirit is in the fabric of our Nation, but we 
must not take it for granted, not cheapen it by failing to provide 
the direction or performance, performing the diligence necessary to 
ensure the astronauts’ safety. 

I would like to thank our witnesses for their appearance before 
the Subcommittee today. I recognize that each of you has spent 
considerable time and effort preparing for this hearing and in some 
cases traveling long, long distances to be here, and we are not 
going to calculate General Stafford’s distance that he has traveled 
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because he has got a big advantage over the rest of us. But please 
know that the Subcommittee appreciates your efforts as well as the 
wisdom and experience you bring and that we will refer to your 
guidance in the coming months and years ahead as the Committee 
goes forward. 

NASA is facing a transition away from the space shuttle to the 
Constellation program, a program that is in the midst of testing 
and design, desperately needs more funds, and thank you, Mr. 
Hanley, for all you have done for the Constellation program. But 
there is a theme across our entire spaceflight program, human 
spaceflight program. An increase in resources would enhance the 
abilities and capabilities of the commercial sector to allow their in- 
creased participation as well. I fully support all of the current en- 
deavors including commercial cargo, but sadly, from my position, 
fully supporting and fully funding are not synonymous. I truly wish 
they were. 

Safety is and must be on the minds of the men and women of 
NASA all the time. We have astronauts orbiting in the ISS right 
now and each shuttle flight carries with it the extra increment of 
risk that an accident could end NASA as we know it. 

I would like in my brief time to focus on an area of concern to 
me that is just as critical as design standards, human ratings re- 
quirements, airworthiness, to name a few, and that is the issue of 
culture. Culture is difficult to define. I know that. But it is some- 
thing that the Columbia Accident Investigation Board spent a great 
deal of time on. It found that, and this is a quote, “The NASA orga- 
nizational culture had as much to do with this accident as the 
foam.” The Augustine report cites that, another quote, “Significant 
space achievements require continuity of support over many years. 
One way to assure that no successes are achieved is to continually 
introduce change.” 

It must not be lost on this committee that the increased partici- 
pation of commercial providers will necessitate a change in busi- 
ness as usual at NASA. We cannot take that lightly. Changing the 
way a bureaucracy operates is not easy. In many cases, it is not 
advisable, and frustratingly, in most cases, not achievable, but 
make no mistake, I am not for letting the status quo dictate the 
way our government runs. I am just stating that in this case, a 
change like this brings challenges and risk that we must not over- 
look. 

The agency faces limited budgets, massive contractor layoffs and 
retirement of the signature program and perhaps a new way of 
doing things. Again, a new way of doing things is not inherently 
bad. I am not saying that. I am just saying it would bring forth 
challenges to a workforce and systems and processes that are every 
bit as difficult as designing rockets. 

I do not believe the CAIB report is a historical artifact but a 
guiding document. The Constellation program was designed with 
the CAIB freshly in mind, and we must keep that report fresh in 
ours as time goes on. 

The challenge of a lack of funding permeates every discussion we 
have about NASA but not a distant second is a lack of commitment 
to a defined program. We have a program before us. It is time we 
committed to it with our actions and the funding necessary to see 
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it through. In my mind, the cost of not doing so far exceeds the 
amount needed to complete the task. We are a Nation founded by 
great explorers who were willing to take great risks. Great success 
is achieved out of the willingness to make great sacrifice. However, 
as a Nation, especially at taxpayer expense, we must be diligent in 
making sure that the promised success is worth the promised sac- 
rifice. 

Thank you. Madam Chairwoman. I yield back my time. 

[The prepared statement of Mr. Olson follows:] 

Prepared Statement of Representative Pete Olson 

Madam Chairwoman, thank you for calling this morning’s hearing on a topic of 
paramount importance to the future of our human space flight program. The issue 
of safety really is the starting point from which all discussions about the course and 
purpose of our nation’s human space flight program should begin. 

I am certain we would have a line of people out the door (and behind me, by the 
way) to test ride a new rocket. That pioneering spirit is in the fabric of our nation, 
but we must not take it for granted, nor cheapen it by failing to provide the direc- 
tion or performing the diligence necessary to ensure their safety. 

I’d like to thank our witnesses for their appearance today before this sub- 
committee. I recognize that each of you has spent considerable time and effort pre- 
paring for this hearing, and in some cases traveling considerable distance (although 
we won’t calculate all of Gen. Stafford’s career miles) to be here. Please know that 
this subcommittee appreciates your efforts, as well as the wisdom and experience 
that you bring, and that we will refer to your guidance in the months and years 
ahead. 

NASA is facing the transition away from the space shuttle and to the Constella- 
tion program, a program that although is in the midst of testing and design, des- 
perately needs more funds. But that is a theme across our entire human space flight 
program. An increase in resources would enhance the abilities and capabilities of 
the commercial sector to allow their increased participation in space as well. I fully 
support all of the current endeavors, including commercial cargo, but sadly from my 
position, fully supporting and fully funding are not synonymous. I truly wish they 
were. 

Safety is and must be on the minds of the men and women at NASA all the time. 
We have astronauts orbiting in the ISS right now, and each shuttle flight carries 
with it the extra increment of risk that an accident could end NASA as we know 
it. 

I would like in my brief time to focus on an area of concern that to me is just 
as critical as design standards, human-ratings requirements, and airworthiness, to 
name a few (and not making light of any of them) and that is the issue of culture. 

Culture is difficult to define I know, but it is something that the Columbia Acci- 
dent Investigation Board spent a great deal of time on. It found that “the NASA 
organizational culture had as much to do with this accident as the foam.” 

The Augustine report cites that “significant space achievements require continuity 
of support over many years. One way to assure that no successes are achieved is 
to continually introduce change.” It must not be lost on this committee that the in- 
creased participation of commercial providers will necessitate a change in business 
as usual at NASA. We cannot take that lightly. Changing the way a bureaucracy 
operates is not easy, in many cases not advisable, and frustratingly, in most cases, 
not achievable. Make no mistake, I am not for letting the status quo dictate the way 
our government runs, I am just stating that in this case a change like this brings 
challenges, and risks, that we must not overlook. 

The agency faces limited budgets, massive contractor layoffs, the retirement of a 
signature program, and perhaps a new way of doing things. Again, a new way of 
doing things is not inherently bad, I am not saying that, I’m just saying that it will 
bring forth challenges to a workforce and to systems and processes that are every 
bit as difficult as designing rockets. 

I do not believe the CAIB report is a historical artifact, but a Riding document. 
The Constellation program was designed with CAIB freshly in mind, and we must 
keep that report fresh in ours as time goes on. 

The challenge of a lack of funding permeates every discussion we have about 
NASA. But a not distant second is the lack of a commitment to a defined program. 
We have a program before us; it is time we committed to it with our actions and 
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the funding necessary to see it through. In my mind, the cost of not doing so far 
exceeds the amount needed to complete the task. 

We are a nation founded by explorers who were willing to take risks. Great suc- 
cess is achieved out of the willingness to make great sacrifice. However, as a nation, 
especially at taxpayer expense, we must be diligent in making sure that the prom- 
ised success is worth the possible sacrifice. 

Thank you, Madam Chairwoman. I yield back by time. 

Mr. Hall. Will the gentleman yield to me just one minute before 
he yields back his time? 

Mr. Olson. Yes, sir. Yield back to the ranking member. 

Mr. Hall. Madam Chairperson, we have in the audience a long- 
time staffer and part of the bedrock of the NASA program and the 
bedrock of this Committee, Tom Tate. Tom, we are always glad to 
have you back here and thanks for the many years you have spent 
back on this side of the desk. 

Thank you. Madam Chairman. I yield back. 

Chairwoman Giffords. Thank you. 

Because we anticipate votes probably occurring in about 45 min- 
utes, I am going to ask if other members have additional opening 
statements that we submit them for the record at this point. 

We do have a distinguished set of panelists today. I would like 
to introduce them briefly. Mr. Bryan O’Connor is here. He is a vet- 
eran of two space shuttle missions and is currently the Chief of 
Safety and Mission Assurance at NASA. He will be discussing 
NASA’s processes and plans for resolving safety and human rating 
issues. Next we will hear from Mr. Jeff Hanley, who is Program 
Manager for the Constellation program at NASA. He will be dis- 
cussing the steps taken by the Constellation program to maximize 
crew safety in its Ares-Orion System. We will also hear from Mr. 
John C. Marshall, who is a Council Member on NASA’s Aerospace 
Safety Advisory Panel. He will provide the perspectives of the 
agency’s outside safety advisory board. Welcome. Also, we will hear 
from Mr. Bretton Alexander, who is currently the President of the 
Commercial Spaceflight Federation. He will provide the commercial 
industry’s perspectives and plans for addressing crew safety issues. 
Welcome. Dr. Joseph Fragola is Vice President of Valador Incor- 
porated. He has more than 40 years experience in risk analysis in 
the aerospace and nuclear industries and will provide his perspec- 
tives on the issues involved in ensuring the safety of both govern- 
ment and non-government crew space transportation systems, a 
true expert. Welcome, Dr. Fragola. And of course, Lt. Gen. Tom 
Stafford, who has been introduced a couple times already. We are 
just very, very delighted that you are here. 

As our witnesses should know, you will each have five minutes 
for your spoken testimony. Your written testimony will be included 
in the record for the hearing, and when you have completed your 
spoken testimony, we will begin with questions, and each member 
will have five minutes to question the panel, and we would like to 
begin this morning with Mr. O’Connor. 

STATEMENT OF BRYAN O’CONNOR, CHIEF OF SAFETY AND 

MISSION ASSURANCE, NATIONAL AERONAUTICS AND SPACE 

ADMINISTRATION 

Mr. O’Connor. Thank you. Chairwoman Giffords, members of 
the Subcommittee. I appreciate the opportunity to appear here 
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today to discuss how NASA works to ensure the safety of human 
spaceflight. In your letter inviting me to testify at today’s hearing, 
you asked that I address a number of questions related to the Of- 
fice of Safety and Mission Assurance at NASA and how we work 
with safety of human spaceflight. My statement will address those 
questions and provide additional context. 

The Office of Safety and Mission Assurance provides policy direc- 
tion, functional oversight and assessment for all agency safety reli- 
ability and quality engineering activities. We are responsible for 
the agency’s safety and mission assurance requirements and stand- 
ards and we serve as principal advisor to the Administrator on 
matters pertaining to human spaceflight safety and mission suc- 
cess. 

In the past several years, my organization has sponsored several 
initiatives to take advantage of our lessons learned from the past 
50 years of human spaceflight. Included are increased emphasis on 
the qualifications and credibility of our professional workforce, for- 
mal technical authority for associated safety and mission assurance 
requirements as well as the authority to determine safety risk ac- 
ceptability for designs and for operations including human 
spaceflight launch, increased emphasis on safety culture through- 
out the human spaceflight programs. This includes more open com- 
munications including encouragement for dissenting opinions, clear 
appeal paths all the way to the Administrator as necessary for 
safety dissenting opinion, and something we started recently called 
the “Yes If’ initiative. It is an incentive that promotes the ideal 
that credible and capable safety and mission assurance profes- 
sionals don’t simply just know the rules but they understand the 
rationale behind those rules to the point that they can help the de- 
signer and the operator with alternative approaches consistent 
with safety and mission success, improvements in critical software, 
independent validation and verification and improvements in our 
knowledge management systems. A significant portion of these ac- 
tivities as well as improved audits, assessment and mishap inves- 
tigation procedures and capabilities in the agency are primarily 
managed at the new NASA Safety Center, which we established 
two years ago in Cleveland near the Glenn Research Center. 

As I mentioned, much of our current thinking comes from hard 
lessons learned from the past. The Columbia Accident Investigation 
Board documented for us once again the inherent risk of human 
spaceflight, noting that “the laws of physics make it extraordinarily 
difficult to reach earth orbit and return safely.” To justify that risk 
the CAIB called for “a national mandate providing NASA a compel- 
ling mission requiring human presence in space.” It also rec- 
ommended that design of the shuttle replacement should give over- 
riding priority to crew safety rather than to trade safety against 
other performance criteria such as low cost and reusability or 
against advanced space operations capabilities other than crew 
transfer. The X-15 incidents, the Apollo fire, the Challenger, the 
Columbia accidents have caused us to insist on clear lines of ac- 
countability in what we do with strong checks and balances, capa- 
ble systems integration and a strong safety culture with open com- 
munications in all directions. We treat every crewed spaceflight 
like an engineering test flight, retaining adequate program re- 
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sources to thoroughly prepare for each flight and to analyze and re- 
solve ground and flight anomalies. Finally, we emphasize crew es- 
cape and emergency systems to improve crew survivability during 
anticipated or unanticipated flight contingencies. 

We have also learned an awful lot working with our Russian 
counterparts beginning in Apollo-Soyuz and continuing with Shut- 
tle-Mir and the International Space Station about the challenges of 
spaceflight and safety of human spaceflight. For example, we note 
in the Soyuz design the robust reliability and failure tolerance fea- 
tures. The systems for unknown contingencies are treated with ca- 
pable, highly capable abort, escape and emergency systems. 

On the matter of crew egress and escape and abort, the Columbia 
Crew Survival Investigation Report prepared by NASA Spacecraft 
Crew Survival Integrated Investigation Team released last Decem- 
ber is a comprehensive study of crew safety equipment and proce- 
dures used during the Space Shuttle Columbia accident. We have 
made this report available to the Constellation program as well as 
to industry for use and guidance in their design for survivability. 

Finally, as we review the options presented by the Augustine 
panel, we are considering how best to address their suggested com- 
mercial crew transportation options. We are using fiscal year 2009 
Recovery Act funds to supplement or to support activities related 
to technologies that enable commercial human spaceflight capabili- 
ties. We are also investing Recovery Act funds to begin develop- 
ment of a more concise set of human rating technical requirements 
that might apply to non-NASA developers and we are looking at 
appropriate oversight and insight approaches to be used for such 
a venture. 

In closing, the Office of Safety and Mission Assurance plays a 
significant role in assuring safety of human spaceflight. Chair- 
woman Giffords, I would be happy to respond to any questions you 
or other members have on this matter. 

[The prepared statement of Mr. O’Connor follows:] 

Prepahed Statement of Bryan O’Connor 

Chairwoman Giffords and other Members of the Subcommittee, thank you for the 
opportunity to appear today to discuss how NASA works to ensure the safety of 
human spaceflight. In your letter inviting me to testify at today’s hearing, you asked 
that I address a number of questions related to the Office of Safety and Mission 
Assurance and the safety of human spaceflight at NASA. My statement will address 
those questions, and provide additional context. 

The Role of OSMA in Ensuring Human Spaeeflight Safety 

The NASA Office of Safety and Mission Assurance provides policy direction, func- 
tional oversight, and assessment for all Agency safety, reliability, maintainability, 
and quality engineering and assurance activities and serves as a principal advisory 
resource for the Administrator and other senior officials on matters pertaining to 
human spaceflight safety and mission success. As Chief of the Office of Safety and 
Mission Assurance, I report directly to the Administrator. OSMA supports the ac- 
tivities of — but is organizationally separate from — the human spaceflight Mission 
Directorates and the Office of the Chief Engineer, thus providing the Administrator 
an independent view of the safety and effectiveness of human spaceflight designs, 
flight test and mission operations in addition to all other mission roles of the Agen- 
cy. 

Specifically, the Office of Safety and Mission Assurance: 

• Develops strategies, policies, technical requirements, standards, and guide- 
lines for system safety, reliability, maintainability, and quality engineering 
and assurance; 
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• Establishes the applicable set of Safety and Mission Assurance (SMA) re- 
quirements for all human spaceflight programs, and, through delegated tech- 
nical authority, formally approves or disapproves waivers, deviations and/or 
exceptions to same; 

• Verihes the effectiveness of safety and mission assurance requirements, ac- 
tivities, and processes, and updates, cancels or changes them as time, tech- 
nology and/or circumstances dictate; 

• Advises NASA leadership on significant safety and mission assurance issues, 
including investigation of human spaceflight-related mishaps and close calls, 
and provides guidance for corrective actions stemming from those investiga- 
tions as well as corrective actions related to ground and flight test anomalies; 

• Performs broad-reaching independent assessments of human spaceflight-re- 
lated activities, including formal Independent Validation and Verification 
(IV&V) of flight and ground software critical to flight crew safety; 

• Oversees and assesses the technical excellence of safety and mission assur- 
ance tools, techniques, and practices throughout the human spaceflight pro- 
gram life cycle; 

• Provides knowledge management and training in safety and mission assur- 
ance disciplines to the assigned workforce; and, 

• Assures that adequate levels of both programmatic and Center institutional 
resources are applied to safety and mission assurance functions. 

NASA Human Spaceflight Safety Initiatives 

In the past several years, OSMA has sponsored several initiatives with the intent 
of enhancing the safety of human spaceflight. OSMA has increased its emphasis on 
the qualification and credibility of safety and mission assurance professionals by 
working with the Center Directors to assign some of their best and brightest em- 
ployees to safety and mission assurance positions. We have also established a new 
Technical Excellence Program with a four-tier training and qualihcation system for 
all safety and mission assurance professionals across the Agency. Additionally, safe- 
ty and mission assurance professionals assigned to human spaceflight programs now 
have formal technical authority for associated safety and mission assurance require- 
ments as well as the authority to determine safety risk acceptability for designs 
and/or operations, including human spaceflight launch. 

Another initiative is an increased emphasis on safety culture throughout the 
human spaceflight programs. This includes more open communications, including 
encouragement for dissenting opinions; clear appeal paths to the Administrator for 
safety dissenting opinions; and the “Yes if’ initiative, an incentive that promotes the 
ideal that credible and capable safety and mission assurance professionals not sim- 
ply know the rules, but understand their rationale to the point that they can help 
the design or operations team with alternative approaches consistent with safety 
and mission success. 

OSMA has also made improvements in critical software IV&V by increasing the 
emphasis on validation of critical software requirements early in design. The IV&V 
team is also increasing the use of modeling and other systems engineering tech- 
niques to enhance their effectiveness in assessing the safety and utility of the crit- 
ical software. 

Improved knowledge management and requirements management tools and proc- 
esses have also been put into place. This includes dedicated knowledge capture, 
archiving and dissemination activities, as well as better tools for tracking, updating, 
and rationalizing the more than 3,000 NASA technical and operational SMA re- 
quirements (many of which apply to human spaceflight). These activities, as well 
as improved audit, assessment and mishap investigation procedures and capabili- 
ties, are all primarily managed at the NASA Safety Center located near the Glenn 
Research Center. 

Finally, OSMA has increased the amount of mentoring, training and technical as- 
sistance provided by our Headquarters SMA experts to the human spaceflight pro- 
grams and their host Center SMA and engineering organizations. 

Incorporating Lessons Learned into Ageney Standards and Procedures 

The Columbia Accident Investigation Board (CAIB) documented for us once again 
the inherent risk of human spaceflight, noting that “the laws of physics make it ex- 
traordinarily difficult to reach earth orbit and return safely.” To justify the risk, the 
CAIB called for “a national mandate providing NASA a compelling mission requir- 
ing human presence in space.” The Board also recommended that “ the design of 
the Shuttle replacement] should give overriding priority to crew safety, rather than 
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trade safety against other performance criteria, such as low cost and reusability, or 
against advanced space operation capabilities other than crew transfer.” 

The many CAIB recommendations dealing with root causal factors, as well as 
NASA’s own Return to Flight assessments, pointed to several important lessons in- 
cluding, but not limited to, those outlined below. These recommendations and les- 
sons indicate that NASA should: 

• Maintain clear lines of accountability including strong checks and balances 
between program/project managers and their assigned independent technical 
authorities. 

• Organize for a strong program-level systems integration function for complex, 
multi-element human spaceflight programs. 

• Infuse the organization with a strong safety culture with open communica- 
tions in all directions, encouragement of alternate opinions, and formal appeal 
paths for dissent. 

• Treat every crewed space flight like an engineering test flight, and retain ade- 
quate program resources to thoroughly prepare for each flight and analyze 
and resolve ground and flight anomalies. 

• Emphasize crew escape, abort and emergency systems and procedures to im- 
prove crew survivability during anticipated or unanticipated flight contin- 
gencies. 

In the early 1990s NASA engaged in a joint U.S. -Russian project called Shuttle- 
Mir, picking up where the Apollo-So 3 aiz Test Project had left off in 1975. In prepara- 
tion for the joint activity, NASA technical experts, including senior safety engineers, 
spent a significant amount of time over a three-year period talking with Apollo- 
Soyuz veterans, visiting with current Russian counterparts, and reviewing the long 
history of Soyuz, Salyut, and Mir operations in an effort to understand the Russian 
approach to human spaceflight safety. The two governments also established a high- 
level, joint technical oversight body (the Stafford-Utkin, now Stafford-Anfimov, Com- 
mission) in January 1995 to independently review Soyuz readiness for flight and to 
report its findings directly to the heads of agencies. In March 1995, Norm Thagard 
became the first U.S. astronaut to launch on the Soyuz. He and the other five astro- 
nauts who spent time on Mir used the Shuttle for subsequent transportation, but 
they all received training in Soyuz as their primary escape system. 

Following on the success of the Shuttle-Mir program, NASA and the Russian Fed- 
eral Space Agency (Roscosmos) agreed to create a joint space station in 1993. The 
International Space Station (ISS) Intergovernmental Agreement and Memorandum 
of Understanding (the final version of which was signed in 1998) recognized the 
Russian government’s responsibility for crewmember safety for their elements, in- 
cluding Soyuz. The next American to launch on Soyuz was Bill Shepherd, the Com- 
mander of the first ISS increment in October 2000. Like Thagard, Shepherd re- 
turned to Earth on Shuttle, and like the Mir astronauts, he was trained on the 
Soyuz spacecraft. Since then, 14 different NASA astronauts have flown on Soyuz, 
bringing the total NASA astronaut trips to 14 up, and 13 down, several of which 
were made during the post-Columbia Return-to-Flight timeframe. Canadian and Eu- 
ropean partner astronauts have flown to and from ISS on So 3 aiz, and the next Soyuz 
will carry a Japanese partner astronaut. As we speak, So 3 aiz is the primary mode 
of transportation to and from the ISS for all ISS crewmembers. 

NASA’s Russian partner engineers and managers have been open with their de- 
signs, operations, system anomalies, and close calls; however, there have been occa- 
sions when, for various reasons, they have restricted technical information transfer 
to our engineers. On these occasions, perseverance by our technical staff on the 
ground and dependence on the Russians’ proven engineering and operational savvy 
that spans more than 40 years of human spaceflight, have resulted in sufficient con- 
fidence in their systems and operations (approximately 96 percent mission success 
rate, and 98 percent crew safety record for all versions since 1967), and mutual 
trust initiated during the ApolloSoyuz program, and reinforced most recently with 
over 15 years of joint space station operations. Some of the many human spaceflight 
safety lessons from NASA’s joint work with the Russians on Soyuz, Mir, and ISS 
include: 

• The Russian design philosophy depends heavily upon reliability in addition 
to adherence to a strong design heritage (robust systems and failure toler- 
ance, often using dissimilar redundancy), but they are big believers in abort, 
escape, and emergency systems for known or unknown contingencies that are 
not covered by reliability alone. 
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• The Russian design philosophy also rests heavily on testing. During the 
Soyuz update from the TM (modified transport) to TMA (TM anthropometric) 
version (enlarged in the 1990’s to accommodate larger astronauts), they per- 
formed multiple tests, including drop tests, to ensure that the design was 
equivalent, or superior, to previous versions. This testing is often carried to 
conditions beyond the nominal expected environments. As Roscosmos pre- 
pares to upgrade the control computer system on the Soyuz, they are first in- 
stalling and testing this upgrade in the Progress cargo vehicles. In this way, 
they can flight test the system with less critical cargo before it is required 
to transport crew. This provides an additional rigorous test and helps to in- 
sure overall crew safety. 

• The Russian development philosophy is based on evolutionary upgrades, 
keeping what works, and modifying or replacing what does not. 

• The Russian design and operational organizations include reliability and 
quality engineering staffs, but they do not have an independent safety engi- 
neering staff like NASA does. That said, they include many of the same safety 
functions as NASA does as part of the other engineering disciplines, and they 
do provide one of their most experienced engineers as NASA’s SMA counter- 
part. 

• The Russian technical staff is very skilled and displays outstanding knowl- 
edge of the flight systems. With relatively low turnover, they also have excel- 
lent corporate memory, which helps them deal with any repeat problems. 

• The Russians, unlike NASA, rely on automation and ground control for cer- 
tain critical dynamic events like abort initiation, landing, proximity oper- 
ations and docking. 

Although NASA and Roscosmos have occasionally disagreed about relative risk 
levels for such things as orbital debris, battery hazards, etc., our experience to date 
shows us that they have no intention of putting crewmembers in known unsafe situ- 
ations for the sake of expediency. 

The Columbia Crew Survival Investigation Report, prepared by the NASA Space- 
craft Crew Survival Integrated Investigation Team (SCSIIT) and released in Decem- 
ber 2008, is a comprehensive study of crew safety, equipment and procedures used 
during the Space Shuttle Columbia accident. The report contains 29 specific find- 
ings, half of which apply to Space Shuttle and to NASA investigation procedures, 
and half to future designs. The Constellation Program has assessed the report’s 
findings, incorporating several of them into the Orion design, and the Program 
plans to incorporate others as the design matures. The fundamental theme of the 
findings is that human spaceflight programs should include crew survivability in the 
system design, and that operational plans should provide for safe egress, abort and/ 
or escape from contingency situations. This is a top level requirement in NASA’s 
most recent human rating requirements policy contained in NASA Procedural Re- 
quirement (NPR) 8705. 2B (May 6, 2008). The rationale comes from our three fatal 
human spaceflight accidents. It is not enough to design a human spaceflight system 
to be reliable. The Earth-to-orbit mission is about managing incredibly high-energy 
systems and environments, with very little room for error. When measured by num- 
ber of flights, human spaceflight transportation is still relatively immature, and the 
designers and operators are continuously learning about the real risks involved with 
spaceflight activities. Thus, as the report highlights, and the human rating require- 
ments mandate, there is a need to provide the crew with a fighting chance for sur- 
vival if and when something goes wrong, anticipated or not. 

The Constellation Program is using the SCSIIT report as a design guideline; and 
as the Program tailors its suggestions into Program requirements, we in OSMA are 
drafting a follow-on technical standard for use by future human spaceflight system 
developers. The design standard will provide cues for designers and will also make 
it clear that the addition of any systems to increase the survivability of the crew 
needs to consider both the system design and concept of operations. In the mean- 
time, NASA has made the SCSIIT report available to the public, sending copies di- 
rectly to all known commercial space companies. The SCSIIT has also given presen- 
tations about the associated lessons-learned to NASA Centers, as well as to the Na- 
tional Transportation Safety Board, Federal Aviation Administration, the Depart- 
ment of Defense, the Defense Contract Management Agency, and others totaling 
over 4000 people to date. 

Safety and Commercial Spaceflight 

NASA will require that any Earth-to-orbit and/or orbit-to-Earth system that car- 
ries NASA astronauts be human rated, thus ensuring that all of our stringent crew 
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and launch safety requirements would be met before any NASA crew would be al- 
lowed to travel on a spaceflight vehicle. As part of that process, the Agency’s Tech- 
nical Authorities (Engineering, SMA and Health and Medical) will determine which 
of NASA’s mandatory standards apply in designing, manufacturing and operating 
their system. OSMA and the Johnson Space Center SMA organization worked close- 
ly with the Constellation program for over six months in 2008 to establish and tailor 
the applicable SMA requirements for the Constellation Program. This was a very 
detailed and involved activity that reminded us that the job of validating the right 
set of requirements for a new crewed flight system is not a simple cookie-cutter or 
checklist task. Nor is it expected to be a one-time task. The requirements refining 
and tailoring process will continue as we learn more about the design, the environ- 
ment and the operational concepts. NASA’s Commercial Crew and Cargo Program 
Office has initiated an effort to determine and establish the requirements (both 
process and design) as well as any other standards that should apply to commercial 
partners when engaging in services for transporting astronauts. 

Currently, NASA is working with two companies. Space Explorations Technologies 
Corporation (Space X) and Orbital Sciences Corporation (Orbital), as part of indi- 
vidual Commercial Orbital Transportation Services (COTS) projects designed to de- 
velop and demonstrate commercial cargo capabilities to and from low-Earth orbit. 
In doing so, NASA has agreed to pay both companies prenegotiated amounts when 
each company achieves pre-negotiated milestones outlined in Space Act Agreements, 
and OSMA is part of the review team assessing each company’s progress toward 
meeting required milestones. Last year, NASA also issued contracts to both Space 
X and Orbital, for cargo delivery to the ISS under the Commercial Resupply Serv- 
ices (CRS) Program. 

NASA is utilizing FY 2009 Recovery Act funds to support activities to stimulate 
efforts to develop and demonstrate technologies that enable commercial human 
spaceflight capabilities. NASA is also investing Recovery Act funds to begin develop- 
ment of a more concise set of NASA human rating technical requirements. These 
requirements would be applicable to NASA developed crew transportation systems 
as well as commercially-developed crew transportation systems for use by NASA. 
This task is being performed by a team comprised of representatives from NASA’s 
human spaceflight programs, the Astronaut Office, and Agency technical authori- 
ties, including OSMA. We are also consulting with other Government partners such 
as the Federal Aviation Administration and with commercial stakeholders. 

Conclusion 

In closing, the Office of Safety and Mission Assurance plays a significant role in 
ensuring the safety of human spaceflight. By continually improving its workforce, 
communications, and processes, the Office of Safety and Mission Assurance is an or- 
ganization of technical excellence that is well-equipped to support the Agency’s 
human spaceflight safety efforts. By disseminating and incorporating into its stand- 
ards and policies the many lessons learned throughout the history of human 
spaceflight, NASA is able to improve safety in its own future designs, and to facili- 
tate safety in those that may be developed commercially. 

Chairwoman Giffords, I would be happy to respond to any questions you or the 
other Members of the Subcommittee may have. 

Chairwoman Giffords. Thank you, Mr. O’Connor. 

Mr. Hanley. 

STATEMENT OF JEFF HANLEY, PROGRAM MANAGER, CON- 
STELLATION PROGRAM, EXPLORATION SYSTEMS MISSION 
DIRECTORATE, NATIONAL AERONAUTICS AND SPACE AD- 
MINISTRATION 

Mr. Hanley. Good morning. Chairwoman Giffords and members 
of the Subcommittee, thank you for the opportunity to appear here 
today to discuss NASA’s emphasis on the continuing effort to im- 
prove safety factors for our most valuable commodity, NASA’s as- 
tronauts. Simply put, safety is a top priority of NASA’s Constella- 
tion program. 

My testimony today will outline how the Constellation program 
has sought to improve crew safety above that achieved in previous 
crewed spacecraft. This has been accomplished by incorporating 
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safety into the Constellation design process from the very begin- 
ning, and in doing so, we are ensuring that the Constellation vehi- 
cles are being designed to account for future missions beyond low 
earth orbit as well as the less challenging requirements of our cur- 
rent Space Station missions. 

However, before we delve too far into the Constellation program’s 
risk-informed design process, I think it is first important that we 
take a look back where we came from. Many of you have touched 
on some of that foundation here this morning already. Following 
the loss of the Space Shuttle Columbia, NASA chartered the Co- 
lumbia Accident Investigation Board to provide the agency with the 
guidelines for moving forward with our return to flight activities. 
Mr. O’Connor cited the finding in their report, and I won’t repeat 
it here again, that informed our design efforts going forward from 
there. The crew office also put out a memo then in 2004 weighing 
in on the discussion about how the next generation human 
spaceflight system should be designed, stating that an order of 
magnitude reduction “in the risk of loss of human life during as- 
cent compared to the space shuttle is both achievable with current 
technology and consistent with NASA’s focus on steadily improving 
rocket reliability and should therefore represent a minimum safety 
benchmark for future systems.” NASA’s Exploration Systems Ar- 
chitecture Study of 2005 used this guidance in recommending that 
NASA select a single, solid first-stage concept that would later be- 
come known as the Ares I Crew Launch Vehicle. 

Today, the Constellation program has a design goal of increasing 
astronaut safety 10-fold relative to shuttle missions and we believe 
that this goal is achievable for four key reasons. First, Constella- 
tion is utilizing a multifaceted design approach that remains un- 
changed since Apollo: design the system to be inherently as safe as 
we can make it, eliminate known risks and hazards where we find 
them and then add backup such as an abort system to mitigate the 
residual risk. In addition to leveraging systems with human-rated 
heritage such as the space shuttle solid rocket motor, NASA is uti- 
lizing improved computer modeling to help identify, reduce and 
eliminate hazards and risks where we find them. 

Second, unlike the space shuttle, the Orion capsule will have a 
launch abort system. During Apollo, NASA had comparatively little 
experience and computational capability and the abort effectiveness 
of such a system was only estimated. Today we can use advanced 
simulation tools and computers to test within the computer so that 
NASA can conduct a more thorough analysis in addition to uti- 
lizing test flights. 

Third, Constellation has chosen to tightly interweave design and 
safety team members into the design process. The team has ac- 
tively worked with design engineers to provide expertise and feed- 
back via various assessments and analyses throughout the design 
maturation process and that process is ongoing and continues. 

And finally. Constellation has used the agency’s active risk man- 
agement approach that identifies technical challenges early in the 
design process and aggressively works solutions. Technical risks 
are identified by likelihood of occurrence and consequence, allowing 
designers to modify the emerging design to reduce or eliminate 
hazards. 
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Currently, the Constellation program is progressing through an 
active phase of hardware and software tests, and as tests are com- 
pleted and data analyzed, our models will he updated, allowing us 
to improve safety and improve system performance. At the same 
time, we are investing heavily in risk-reduction hardware and ac- 
tivities that will help better calibrate and refine our models and 
simulations data that is essential to incorporate as early as pos- 
sible into the Ares I and Orion designs. 

NASA is also developing an integrated test and verification plan 
as part of its program preliminary design review in the next cal- 
endar year that includes a series of developmental tests to further 
refine and validate our designs. For example, on October 28, NASA 
completed the Ares I-X test flight at the Kennedy Space Center in 
Florida, and although the data is still being collected and processed 
from more than 700 onboard sensors, the data is already providing 
tremendous insight into the aerodynamic, acoustic, structural, vi- 
brational and thermal forces that Ares I is expected to experience, 
knowledge that will contribute substantially to the reliability and 
safety of the Ares I design. 

In closing, I would like to reiterate that safety is and always will 
be our number one priority in everything we do and that everyone 
at NASA is dedicated to ensuring that our astronauts are equipped 
to safely conduct the missions asked of them and that they are able 
to return safely home. 

Chairwoman Giffords, I would be pleased to respond to any ques- 
tions the member might have. 

[The prepared statement of Mr. Hanley follows:] 

Prepared Statement of Jeffrey Hanley 

Chairwoman Giffords and Members of the Subcommittee, thank you for the oppor- 
tunity to appear today to discuss NASA’s next-generation human spaceflight pro- 
gram and the Agency’s emphasis on continuing to improve safety factors for our 
most valuable assets — the men and women who dare to explore the mysteries of our 
universe. Everyone at NASA is dedicated to ensuring that these brave pioneers are 
equipped to safely conduct the missions asked of them, and that they are then able 
to safely return home to their loved ones. Simply put, safety is the first of our core 
values at NASA, and it is also the top priority of the Agency’s Constellation Pro- 
gram. 

As requested in your invitation to me to testify at today’s hearing, my testimony 
will outline NASA’s ongoing focus on safety matters with regard to human 
spaceflight, focusing primarily on how the Agency sought to improve crew safety for 
the Constellation Program above that achieved on previous crewed spacecraft. This 
has been accomplished by incorporating safety in all aspects of Constellation from 
the beginning of the design process. My testimony will also outline how the Con- 
stellation Program has processed into the early developmental testing stages, and 
how data from those tests is being used to improve our models and to validate the 
rigorous safety requirements developed for the Constellation vehicles. 

Columbia Accident Investigation Board and the Exploration Systems Archi- 
tecture Study 

In 2003, the Columbia Accident Investigation Board (CAIB) report provided NASA 
with guidelines for moving forward with our return to flight efforts. In addition to 
determining the causes of the Columbia accident, the CAIB also provided the Agen- 
cy with a set of comprehensive recommendations to improve the safety of the Space 
Shuttle Program and to change the corporate culture of the Agency — changes that 
have positively impacted the Constellation Program. NASA has also established 
processes that enhance our ability to assess risk and to improve communication 
across all levels and organizations within the Constellation team. 

More specifically, with regard to the design of the next-generation crew launch ve- 
hicle, the CAIB recommended that: 
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“The design of the system [that replaces the Shuttle] should give overriding pri- 
ority to crew safety, rather than trade safety against other performance criteria, 
such as low cost and reusability, or against advanced space operation capabili- 
ties other than crew transfer.” 

In other words, the CAIB gave NASA clear guidance that the next-generation 
crew launch vehicle should he simpler and safer, and that crew safety should he the 
driving design principle. Now the question became, how did we meet this challenge? 
More specifically, how did we make a vehicle “inherently safe” while also protecting 
against residual risk, in a mass-constrained, highly-energetic system such as a 
launch vehicle? We started by going back to the basics, first identifying the known 
risks and hazards and then working to eliminate, or at least to minimize, each one 
of them. From there, the designers turned their attention to developing acceptable 
mitigation approaches for the residual risks. From the beginning, this complicated 
and lengthy process, known as risk-informed design, has been at the heart of 
NASA’s Constellation Program. 

However, before there was even a program known as Constellation, NASA used 
the CAIB guidance and other policy directives to initiate the Exploration Systems 
Architecture Study (ESAS) in 2005 with the purpose of assessing and defining the 
top-level requirements and configurations for crew and cargo launch systems, not 
only to support future lunar and Mars exploration programs, but also to support the 
International Space Station. 

In conducting its review, the ESAS team focused on guidance issued by the Chief 
of the Astronaut Office in May 2004 — particularly on one key statement, which 
states: 

The Astronaut Office believes that an order-of-magnitude reduction in the risk 
of loss of human life during ascent, compared to the Space Shuttle, is both 
achievable with current technology and consistent with NASA ’s focus on steadily 
improving rocket reliability, arid should therefore represent a minimum safety 
benchmark for future systems. This corresponds to a predicted ascent reliability 
of at least 0.999. 

Keeping in mind the CAIB recommendation of focusing on crew safety first, ESAS 
placed a premium on crew safety. All candidate crew launch vehicle concepts consid- 
ered during ESAS included an escape capability referenced as a launch abort system 
or LAS. During the study, NASA eliminated any launch vehicle concept that did not 
approach at least a predicted probability for loss of crew (LOC) of 1 in 1,000 mis- 
sions. In addition, concepts that would place the crew module in close proximity to 
the boosters and/or other potential sources of accident initiation were eliminated to 
improve the reliability of a LAS and to improve the likelihood of crew survival in 
the event of an accident during ascent. This process resulted in the selection of the 
single solid First Stage concept, which would later become known as the Ares I 
Crew Launch Vehicle. In the end, the potential for increased safety provided by Ares 
I (compared to other alternatives considered during ESAS) was based primarily on 
the simplicity of the First Stage. 

As compared to the Space Shuttle, the Ares I will be a simpler vehicle to process 
prior to launch because NASA has designed the Ares Ito have fewer moving parts, 
thus requiring less hands-on labor prior to launch, and also reducing the potential 
for human error. In addition to the inherent safety associated with the rocket’s sim- 
plified design, the Ares I integrated rocket will have a LAS for crew, as will be out- 
lined in greater detail during the next section of this testimony. 

The Constellation Program and Risk-Informed Design 

In the Apollo era, crewed launchers were designed with the best level of expertise 
available, tested to exhaustion, and then robustness or redundancy was added to 
mitigate the residual risk. The goal was to make the design as reliable as possible, 
so that backup systems would never have to be used, and to make the backup sys- 
tems as robust as possible to meiximize the likelihood of crew survival and return, 
should a failure (anticipated or not) of the primary system or element take place. 
This approach worked, producing dramatic advances in reliability and crew safety, 
as proven, for example, when the Lunar Module did not experience a single anomaly 
on the final lunar mission, and the crew survived despite the explosion aboard the 
Command/Service Module during the Apollo 13 mission. However, as my colleague, 
Bryan O’Connor, will outline in his testimony, safety at NASA is also about more 
than design. NASA’s focus on safety also includes ensuring that our crews and oper- 
ators know how to deal with contingencies, and that, when someone has a concern 
about a safety issue, whether it be a crew member, a design team member etc. that 
there are clear paths for those who have dissenting opinions to raise their concerns 
to senior management. 
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Today, NASA’s Constellation Program has a goal of increasing astronaut safety 
tenfold relative to Shuttle missions. While a seemingly daunting challenge, NASA 
believes that this goal is achievable for many reasons. 

First, NASA is utilizing a multi-faceted design objective for safety that remains 
the same as during the Apollo era — design the system to be as inherently safe as 
we can make it, and then add backup to mitigate the predicted as well as unknown 
residual risk. This, along with aforementioned guidance issued by the Chief of the 
Astronaut Office in May 2004, was the starting point of the Constellation design 
team. As has been stated, inherent safety implies the elimination of hazards that 
have historically been associated with the operation of the type of system being de- 
signed. This, in turn, implies the systematic identification of the hazards associated 
with operation of the system alternatives being considered. 

The key to a risk-informed design is integrating risk analysis into the design al- 
ternative evaluation and selection process in a fundamental way by using newly ca- 
pable, logical, and phenomenological (or physics-based) computer models. These 
models help focus the design effort toward identifying and reducing or eliminating 
design hazards, which, in turn, helps NASA identify and develop mitigation ap- 
proaches to address the residual risks. In addition, NASA recognizes that safety of 
an overall system can be improved by addressing human factors issues, which is 
why the Ares I Upper Stage and Orion designs have been developed to simplify and 
automate processing and operations as much as possible, thus reducing the poten- 
tial for human error. 

Second, unlike the Space Shuttle, the Orion crew capsule will have a LAS that 
will offer a safer and more reliable method of moving the entire crew out of danger 
in the event of an emergency on the launch pad or during the climb to Earth orbit. 
Mounted at the top of the Orion and Ares I launch vehicle stack, LAS will be capa- 
ble of automatically separating the Orion from the launch vehicles and positioning 
the Orion and its crew for landing. In comparison, during Apollo, NASA had com- 
paratively little experience and computational capability, and the abort effectiveness 
was estimated by comparison to escapes from high-performance military aircraft 
combined with the results of a few escape system tests. Today, with the flight tests 
combined with advanced simulation tools and advanced computers available, NASA 
can conduct a more thorough analysis. Specifically, the integrated abort system’s ef- 
fectiveness can now be calculated using computer models of the blast environment 
by employing more realistic, physics-based, simulations of abort conditions. While 
computer models and computational capability were much less capable during the 
Apollo era, today this calculation can be carried out with remarkable speed and ac- 
curacy given NASA’s evolved engineering expertise and the computational power of 
our computers. 

Third, Constellation has chosen to tightly interweave the design and safety team 
members into the decision making process. As a result, the Constellation team rep- 
resents skills from safety and reliability engineering disciplines traditionally found 
under the Safety and Mission Assurance organizations, as well as engineers with 
backgrounds such as computational fluid dynamics, aerospace, and physics dis- 
ciplines. The team has been given the clear direction to work daily with the design 
engineers to provide expertise and feedback via various assessments and analysis 
techniques throughout the design maturation process. This investment dem- 
onstrates a sincere commitment to the CAIB findings. 

Finally, as a key element of our risk-informed design process, the Agency has an 
active risk-management process that identifies technical challenges early in the 
process and aggressively works solutions. The Program identified key risks during 
the risk management process and associated mitigation steps to inform the designs. 
Technical risks are identified by likelihood of occurrence and consequence. For ex- 
ample, NASA is currently working a thrust oscillation risk for the Ares I First 
Stage. This phenomenon is a characteristic of all solid rocket motors. NASA has 
made significant progress in identif 3 dng both primary and backup approaches to 
mitigate the oscillation effect, and we now believe that we have now baselined a 
passive mitigation technique. However, additional testing will continue to ensure we 
have the best mitigation prior to making the final decision at the Constellation Pro- 
gram’s Preliminary Design Review (PDR) early next year. With regard to the Upper 
Stage, the J-2X engine remains a priority, with the focus being on achieving needed 
performance requirements while also incorporating modem approaches (e.g., mate- 
rials, manufacturing, electronics, etc) into this Apollo-era heritage hardware. 

In choosing a Shuttle-derived architecture, NASA recognized from the outset that 
some of the heritage hardware would need to be modified or replaced so as to 
achieve improved safety, reliability, as well as to meet needed performance and 
lower lifecycle costs. At the same time, the Agency recognized that leveraging sys- 
tems with human-rated heritage would reduce the uncertainties and risks associ- 
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ated with developing a new human-rated crew launch vehicle. For example, the Ares 
I First Stage consists of a five-segment reusable solid rocket motor (RSRM), an aft 
skirt, a forward skirt, and a frustum. The five-segment RSRM is an evolutionary 
development from the four-segment solid RSRM strap-ons currently utilized to 
power the Space Shuttle. As a result, the Constellation Program is building on the 
proven track record of this heritage hardware. There have been 252 solids flown in 
the Shuttle Program with one failure (Challenger STS-51L). The Ares I also bene- 
fits from the improvements in the RSRMs that have resulted from recovery and 

g ost-flight inspections along with modifications that have been made to the Shuttle 
oosters. The Ares I booster also will continue the protocol of recovery and post- 
flight inspection that began in the Shuttle Program. 

The J-2X engine would be used for both the Ares I and Ares V vehicles, thus cre- 
ating a common link between the two vehicles that is based on evolved heritage 
hardware, specifically the powerful J-2 engine that propelled the Apollo-era Upper 
Stage on the Saturn I-B and Saturn V rockets, and the J-2S that was developed 
and tested in the early 1970s. In addition, the J-2X will leverage knowledge from 
the Delta IV’s RS-68 by incorporating manufacturing techniques from the RS-68 
into the J-2X engine. However, NASA recognizes that there are also challenges in- 
volved with utilizing and integrating heritage systems into new vehicles, so for the 
J-2X, NASA has taken steps to increase the amount of component-level testing, to 
procure additional development hardware, and to work to make a third test stand 
available to the contractor earlier than originally planned. 

Already, the Ares I risk assessment and failure analysis teams have provided 
input and/or impacted the outcome of Ares I design issues, trades, or risks on nu- 
merous challenges, including: 

• Abort triggers study: Provided LOG and Abort Effectiveness assessments, in- 
cluding engineering models and timing, to determine what potentially cata- 
strophic scenarios warrant abort sensors and software algorithms; 

• Separation study (booster deceleration motors ): Hazard analysis combined 
with probabilistic design analysis led to the design decision to increase the 
number of booster deceleration motors from eight to 10; and, 

• The Hazards Team identified that the First Stage and Upper Stage designs 
failed to meet properly at the interface flange (due to differing number of 
bolts) and a re-design was instituted. The team provided an assessment to 
Upper Stage that resulted in clocking of the hydrogen and oxygen vents to 
improve separation distance. 

While NASA awaits further direction from the President and Congress with re- 
gard to the future of human spaceflight, the Agency is continuing to pursue our cur- 
rent programs, per direction from the Office of Science and Technology Policy. Cur- 
rently, the Constellation Program is progressing through an active phase of hard- 
ware and software tests and, as tests are completed and data analyzed, our models 
will be updated, allowing us to improve safety and improve systems performance. 
At the same time, we are investing heavily in risk-reduction hardware and activities 
that will help calibrate and refine our models and simulations related to the Ares 
I and Orion — data that is essential to incorporate as early as possible into vehicle 
designs, based on the Program’s risk-based design approach. NASA is developing an 
Integrated Test and Verification plan that includes a series of developmental tests 
to further refine and validate our designs. Test flights, for example, are being de- 
signed to include several hundred measurement points that will characterize the ac- 
tual operating environment and system performance in the most stressing of cases. 
NASA is in the process of continuing to refine this test and verification strategy 
prior to the Program’s PDR early next year, when the Integrated Test and 
Verification plan will be baselined. 

Following are just a few examples of recent and upcoming developmental tests 
which have yielded, or are expected to yield, significant amounts of data that will 
be incorporated into our risk-based design effort: 

• In September 2009, NASA and ATK conducted the first test of the Ares I’s 
five-segment development motor in Promontory, Utah. This test provided 
NASA with valuable thrust, roll-control, acoustics and vibration data as engi- 
neers continue to design the Ares I. In all, seven ground tests are scheduled 
for the five-segment booster. 

• In October 2009, the Ares I-X test flight took place at Kennedy Space Center 
in Florida. Although data is still being collected and processed from more 
than 700 on-board sensors, preliminary results show that the vehicle per- 
formed precisely as it was meant to perform. Early data shows that the vehi- 
cle was effectively controlled and stable in flight. Thrust oscillation fre- 
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quencies and magnitude data from the Ares I-X flight are consistent with 
measurements from recent Shuttle flights that were instrumented, leading us 
to conclude that the oscillation vibration on the Ares I would be within the 
bounds that the Ares I is currently being designed to. When assessment of 
this data is finalized, we believe it will provide tremendous insight into the 
aerodynamic, acoustic, structural, vibration, and thermal forces that Ares I is 
expected to experience — knowledge that will contribute substantially to the 
reliability and safety of the Ares I design, as well as to enhancing NASA’s 
modeling capabilities for future vehicles. 

• In March 2010, NASA plans to perform its first developmental test of the 
Orion LAS at the White Sands Missile Range, New Mexico. This test will vali- 
date the LAS design approach and will contribute substantially to the Orion’s 
final designs for reliability and safety. NASA plans a series of tests to charac- 
terize the LAS. The Pad Abort I test is the first of these tests, and it will 
address what happens if an emergency occurs while the Orion and the launch 
vehicle are still on the launch pad. Other tests will determine how the LAS 
performs in critical parts of the flight regime. 

Human Rating and the Constellation Vehicles 

The launch of any spacecraft is a very dynamic event that requires a tremendous 
amount of energy to accelerate to orbital velocities in a matter of minutes. There 
also is significant inherent risk that exposes a flight crew to potential hazards that 
could be catastrophic, if not controlled. Therefore, through a very stringent process 
of human rating, NASA attempts to eliminate hazards that could harm the crew, 
control the hazards that do remain, train the crews and operators to react appro- 
priately, control the manufacturing and test of all components to minimize errors, 
and provide for crew survival even in the presence of system failures. Spaceflight 
vehicles are cleared by NASA to carry crew for missions that are associated with 
specific mission and performance requirements in an engineering flight test environ- 
ment. It is also important to note that certification is made for an entire spaceflight 
system (i.e. Ares I, Orion, and associated ground support infrastructure count as one 
entire system), and not for specific elements of a system. NASA is currently in the 
process of developing those specific mission requirements for Ares I and Orion. 

To guide the evolution of human rating requirements for any mission, NASA is 
developing Agency-level requirements documents. However, human rating a 
spaceflight system is not as easy as following one document. Instead, it is an intri- 
cate, continuing process, involving the translation of requirements into designs that 
can be built, tested, and certified for flight, and an understanding of risks with miti- 
gation approaches in place. However, the challenge to projects such as Ares I and 
Orion is that there is no single document that spells out what they should do to 
receive a human rating certification from the Agency. 

NASA is investing FY 2009 Recovery Act funds to begin development of a more 
concise set of NASA human rating technical requirements. These requirements 
would be applicable to NASA developed crew transportation systems as well as com- 
mercially-developed crew transportation systems for use by NASA. This task is 
being performed by a team comprised of representatives from NASA’s human 
spaceflight programs, the Astronaut Office, Agency technical authorities, including 
the Office of Safety and Mission Assurance. We are also consulting with other Gov- 
ernment partners such as the Federal Aviation Administration and with commercial 
stakeholders. 

Conclusion 

In closing, I would like to quote from the October 2009 Review of U.S. Human 
Spaceflight Plans report: “Human space travel has many benefits, but it is an inher- 
ently dangerous behavior.” NASA wholeheartedly endorses this statement because 
it is a challenge we live with day in and day out. Safety is and will always be our 
number one priority in everything we do. That is why the Constellation Program 
has employed a continuous risk-informed design process, and that is why our de- 
signs are being developed with an overriding priority given to crew safety at every 
stage of the design and operational process. 

Chairwoman Giffords, I would be pleased to respond to any questions that you 
or the other Members of the Subcommittee may have. 

Chairwoman Giffords. Thank you, Mr. Hanley, for your testi- 
mony. 

Next we will hear from Mr. Marshall. 
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STATEMENT OF JOHN C. MARSHALL, COUNCIL MEMBER, 

AEROSPACE SAFETY ADVISORY PANEL, NATIONAL AERO- 
NAUTICS AND SPACE ADMINISTRATION 

Mr. Marshall. Chairwoman Giffords and other distinguished 
members of the committee, good morning. Thank you again for in- 
viting the ASAP to testify before your Subcommittee today. 

As you may know, today’s topic has been area of interest that the 
ASAP has focused on for a sustained period. Most recently we vis- 
ited SpaceX and Orbital Sciences, both currently commercial pro- 
viders to NASA for logistics re-supply to the Space Station, to dis- 
cuss firsthand their approach to integrating safety into their vehi- 
cles. 

Of course, interest in using the commercial space industry to ful- 
fill NASA’s crew delivery services to low earth orbit, LEO, has 
spiked because of the recent Augustine report recommendations 
that appropriate consideration be given to turning the service over 
to the commercial sector. In making this recommendation, they 
also noted that while safety never can be absolutely assured, safety 
was assumed to be a given. The ASAP believes this assumption 
was premature and an oversimplification of a complex and chal- 
lenging problem in that there is no cookie cutter approach to safety 
in space nor is it a “given.” 

NASA’s Procedural Requirements, NPR 8705.2b, identifies the 
human rating process for NASA space systems. It specifies a risk- 
based approach to evaluate a system against pre-established re- 
quirements. It does not, however, establish what those require- 
ments are. NASA emphatically intends this document to be a start- 
ing point with detailed requirements to be tailored specifically for 
each NASA human spaceflight program including a possible NASA- 
crewed COTS mission. 

Because it is illogical to rely on commercial providers to develop 
their own requirements for contractual services on human 
spaceflight to NASA, the ASAP strongly believes that specific cri- 
teria should be developed to establish how safe is safe enough for 
these services. In addition, it is imperative that the COTS enter- 
prises understand in detail how verification of compliance shall be 
demonstrated. This just now is being developed by NASA. 

With the above background, I will now briefly address the four 
questions that you asked us to talk to. First was, what do you con- 
sider to be the most safety-related issues that will have to be ad- 
dressed if NASA were to consider using commercial providers for 
crew transportation and station crew rescue services. The ASAP 
believes that ensuring the safety of NASA’s astronauts that we 
send into space may be the hardest part of commercialization of the 
LEO crew transportation mission. Significant challenges to be 
solved include first establishing detailed safety requirements that 
NASA deems essential to safe flight. There must be clear and en- 
forceable form that can be placed into a contract and tested for 
compliance. Second, because no launch vehicle can be considered 
truly safe in the conventional sense of the word, establishing min- 
imum acceptable safety levels to guide systems safety design and 
a baseline for both NASA and their contractors as to what is safe 
enough is critical. Third, much of the inherent safety of spacecraft 
design depends upon choices and decisions where risks are weighed 
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against performance costs and schedule. A process to ensure that 
all the potential hazards are properly vetted by both the govern- 
ment and contractors is important. This will require more than the 
hands-off approach that some envision. And finally, establishing a 
disciplined process-related checks and balances so that NASA can 
verify that the contractor has demonstrated compliance with the 
launch vehicle designs requirements is necessary. 

The next question was, what safety standards should commercial 
entities have to meet if they are chosen by NASA to carry U.S. gov- 
ernment astronauts to low earth orbit and what will be required 
for verification? As noted previously, NASA’s NPR procedures pre- 
scribe a human rating process for NASA’s space system. This docu- 
ment, changed in 2008, represents a significant and substantive 
shift from the prescriptive approach to one that applies good engi- 
neering standards and judgments. Prescriptive standards describe 
how things get done and are applied rigidly. A good-judgment ap- 
proach offers less specific direction and guidance. The ASAP sees 
advantages in both but with a clear need for written guidance of 
record of change and direct connectivity to establish time-tested en- 
gineering standards. 

In this regard, it is the ASAP position that any new standards 
for commercial entities should begin with NASA’s NPR and that 
the human rating for each system must appropriately be tailored 
to combine robust design, solid engineering, and testing along with 
a system safety approach for examining options to minimize the 
probability and impact of failure. Doing so will in the end provide 
both higher reliability and safety for human life. With respect to 
demonstration, verification and certification, the ASAP agrees that 
each of these actions must be performed for both government and 
commercial programs prior to NASA’s use. It also is the ASAP’s po- 
sition that NASA is the best qualified to be the oversight body for 
each of these actions. 

Three: What would be required to certify the airworthiness of 
any commercially provided crew transportation system or station 
rescue service prior to its use by U.S. government astronauts? How 
long do you anticipate such certification would take? As you know, 
airworthiness certification is a process that is carried out by a reg- 
ulatory body. Typically, it is an agency such as the FAA or govern- 
ment organization. Certification gives assurance that necessary 
practices, policies and criteria have been satisfied to protect the 
safety of the crew, passengers and the public from harm due to a 
design or operational flaw in the functioning of the vehicle. For cer- 
tification of any commercial or government space transportation 
system, it is clear that the human rating standard would have to 
be understood by all of the participating parties once those stand- 
ards are known and it is incumbent upon any party presenting a 
vehicle for use to present compelling evidence that the standards 
have been met. That evidence can take several forms, most of 
which are covered by standard industry practices. In the case of 
crew delivery, cargo delivery, rescue from the station, it is well to 
remember that it must not only be certified for its own safe oper- 
ations in itself but must also be able to approach, dock and inter- 
face with the station without presenting a hazard to that vehicle 
as well. 
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In response to the question of how long such a process would 
take, our experience indicates that this is a function of two things. 
First, there must be clarity and mutual understanding the require- 
ments and a process for verifying the requirements have been met. 
Second, there must be an openness and degree of sharing of co- 
operation of the design process to the reviewing authority. Of 
course, the completion of the review remains directly proportional 
to the complexity and uniqueness of the proposed system. 

Finally, in the annual report that ASAP published for 2008, the 
ASAP is concerned about human rating requirements substance, 
applications and standards NASA-wide. What is the basis for this 
concern? The basis for our concern is that in more than two years 
into the COTS program, efforts to develop human rating standards 
for a COTS-D-like program have only just begun and no guidance 
thus far has been promulgated. Therefore, it is premature to con- 
sider any potential COTS-D vehicle as being human rated. If 
COTS entities are to ever provide the level of safety expected for 
NASA crews, it is imperative that NASA’s criteria for safety design 
of such systems quickly be agreed upon and provided to current or 
future providers. 

I would be happy to respond to any other questions you or any 
other members may have. 

[The prepared statement of Mr. Marshall follows:] 

Prepared Statement of John Marshall 

Chairwoman Giffords and other distinguished members of the Subcommittee, good 
morning. Thank you for inviting the Aerospace Safety Advisory Panel (ASAP) to tes- 
tify again before your Subcommittee on the topic of ensuring human space flight 
safety in future government and potential future non-government space transpor- 
tation systems. 

As you may know, this topic has been an area of interest that the ASAP has fo- 
cused on over a sustained period. Most recently we have visited the Space Explo- 
ration Technologies Corporation (Space X) and Orbital Sciences Corporation, both 
currently commercial providers to NASA for logistical re-supply to the International 
Space Station (ISS) — and possible Commercial Orbital Transportation Services 
(COTS-D) providers in the future, to discuss firsthand their approach towards inte- 
grating safety into their vehicles. 

Of course interest in using the commercial space industry to fulfill NASA crew- 
delivery services to Low Earth Orbit (LOE) has spiked because of the recent Augus- 
tine report recommendation that appropriate consideration be given to turning this 
service over to the commercial sector. 

Unfortunately, in making this recommendation they also note that while human 
safety never can be absolutely assured, safety was assumed to be “sine qua non,” 
or “a given” in their recommendation. The ASAP believes this assumption is pre- 
mature and over simplifies a complex and challenging problem, in that there is no 
“cookie-cutter approach” to safety in space. Nor is it “a given.” 

We further believe that since NASA has given serious consideration only recently 
to what their approach will be in establishing human rating requirements for a ve- 
hicle that is occupied by NASA personnel, the commercial sector may be substan- 
tially behind in addressing human rating requirements for the future. 

NASA’s Procedural Requirements (NPR) 8706.2b identifies the human rating re- 
quirements for NASA’s space systems. It contains recently updated requirements 
and captured lessons learned that are applicable to the development and operation 
of crewed space systems. NASA emphatically intends this document to be a starting 
point with detailed requirements to be tailored specifically for each NASA human 
spaceflight program, including a possible NASAcrewed COTS mission. Additionally, 
NASA specifically caveats that the results of any tailored effort for a NASA-crewed 
COTS mission could be different from that developed for a NASA program. 

Because it is illogical to rely on commercial providers to develop their own re- 
quirements for contractual services on human spaceflight to NASA, the ASAP 
strongly believes that specific criteria should be developed to establish how safe is 
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“safe enough” for these services, including the need to stipulate directly the accept- 
able risk levels for various categories of activity. In addition, it is imperative that 
the COTS enterprises understand in detail how verification of compliance shall be 
demonstrated. This too is just now beginning development by NASA. 

With the above background, I will now briefly address the four specific questions 
that you posed to the panel: 

1. What do you consider to be the most significant safety-related issues that 
will have to be addressed if NASA were to consider using commercially pro- 
vided crew transportation and International Space Station (ISS) crew rescue 
services? 

Response: Ensuring the safety of the NASA astronauts that we send into space 
may be the hardest part of commercializing LEO crew transportation. The signifi- 
cant challenges to be solved include: 

• Establishing detailed safety requirements that NASA deems essential to safe 
flight. These must be in a clear and enforceable form that can be placed on 
contract(s) and tested for compliance. 

• Because of their energy, speed, and complexity, no launch vehicle can be con- 
sidered truly “safe” in the conventional sense of the word. Therefore, estab- 
lishing minimum acceptable safety levels to guide system designs and set the 
baseline for both NASA and their contractors as to what is “safe enough” is 
critical. 

• Even with clear safety requirements and levels, much of the inherent safety 
of complex systems like spacecraft depends upon the design choices and deci- 
sions where risks are weighed against performance, costs, and of course, 
schedules. An open and effective system has been developed within NASA to 
accomplish this. A similar process needs to be institutionalized by any com- 
mercial provider as well, whereby all potential hazards are properly vetted by 
both government and contractors. This will not be easy and may require more 
than the “hands ofF approach envisioned by some. 

• Establishing disciplined program and process-related checks and balances so 
that NASA can verify that the contractor has evidence of compliance with the 
launch vehicle design requirements in the as-built vehicle and successful com- 
pletion of the activities necessary to demonstrate mission readiness. 

2. What safety standard should commercial entities have to meet if they are 
chosen by NASA to carry U.S. government astronauts to LEO, and what will 
be required to verify compliance? 

Response: As noted previously, NASA’s NPR 8705.2b prescribes human rating 
requirements for NASA’s space systems. This document, changed in 2008, rep- 
resents a significant and substantive shift from a prescriptive approach to one that 
applies good engineering judgment. Prescriptive standards describe how to do things 
and are applied rigidly. Good judgment offers less specific direction and guidance. 
The ASAP sees advantages in both, but with a need for clear written record-of- 
change and direct connectivity to establish and time-tested engineering standards. 

In this regard, it is the ASAP’s position that any new standards for commercial 
entities should begin with NASA’s NPR — the “gold standard” if you will — and that 
the human rating for each system must appropriately be tailored to combine testing, 
solid engineering, and robust design along with a system safety approach for exam- 
ining options to prevent and minimize the impact of failures. Doing so will, in the 
end, provide both high reliability and safety of human life. 

With respect to demonstration, verification, and certification, the ASAP agrees 
that each of these actions must be performed for both government and commercial 

g rograms prior to NASA’s use. Eurther, it also is the ASAP position that NASA is 
est qualified to be the oversight body for each of these actions as today only NASA 
has the competence in hand to effectively audit the complex technical work required. 

3. What would be required to certify the “airworthiness” of any commercially 
provided crew transportation and ISS rescue service prior to its use by U.S. 
government astronauts? How long do you anticipate such certification would 
take? 

Response: Similar to other certifications, “airworthiness certification” is a process 
that is carried out by a regulatory body. Typically that is an agency such as the 
Eederal Aviation Administration or other governmental body that acts in the inter- 
est of the party having the most critical concern in the outcome. Certification is an 
oversight process, which serves to give assurance that necessary practices, policies, 
and criteria have been satisfied to protect the safety of the crew, passengers, and 
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the public from harm due to a design or operational flaw in the functioning of the 
vehicle. 

Building on this basic principal, for certification of any commercial or government 
space transportation system, it is clear that human rating standards that have been 
discussed in prior answers would have to be developed, published, and understood 
by all participating parties. 

Once those standards are known, it then is incumbent on any party presenting 
a vehicle for utilization covered under the certification process to present compelling 
evidence that the standards have been met. That evidence can take several forms, 
most of which are covered by standard industry practice. 

Testing typically is used to verify that the design meets the standard. The sim- 
plest of these would be the proof testing of pressure vessels that has been common 
for most of the last century. When testing is not possible because it is either too 
dangerous or involves conditions that cannot be set up in the laboratory, then anal- 
ysis or sub-scale experiment is accomplished. Finally, well-validated analysis (finite 
element structural analysis, computational fluid dynamics, physics based simula- 
tions) can form an acceptable mechanism to show compliance. 

In the case of crew delivery, cargo delivery, and rescue from the ISS it is well 
to remember that not only must the certified vehicle be safe in and of itself, but 
it must be able to approach, dock, and interface with the ISS without presenting 
a hazard to that vehicle as well. This means that besides the certification standards 
for the vehicle in question it will also have to meet additional requirements for oper- 
ation in the vicinity of and docking to/departing from the ISS. These standards have 
already been developed and thus any new vehicle certification would also have to 
meet these requirements. 

In response to the question of how long such a process would take, our experience 
indicates that this is most certainly a function of two things. First, there must be 
clarity and mutual understanding of the requirements and a process for verif 3 dng 
that the requirements have been met. Second, there must be openness and a degree 
of sharing/cooperation/transparency of the design process to the reviewing authority. 
Waiting until the design is complete and all parts and pieces are in place, sealed, 
and potentially inaccessible before inviting review of the design would be a recipe 
for failure. Conversely, providing periodic design reviews, openness for witnessing 
testing, clarity of anal 3 d;ical methods as the work progresses can assure a process 
with minimum to no delay. If the data is delivered as requested, testing is witnessed 
as it takes place, and the analysis uses known and validated methods, the finaliza- 
tion of the review remains directly proportional to the complexity and uniqueness 
of the proposed system. Missing or absent data, analysis that is incorrect or faulty, 
and tests that have been done but not confirmed can extend the process indefinitely. 

4. In its annual report for 2008, the ASAP stated “the ASAP is concerned about 
human rating requirements substance, application, and standardization 
NASA-wide.” What is the basis of ASAP’s concern? 

Response: The basis for our concern is that more than two years into the COTS 
program, efforts to develop human rating standards for a COTS-D like program 
have only just begun and no guidance thus far has been promulgated. If COTS enti- 
ties are ever to provide the level of safety expected for NASA crews, it is imperative 
that NASA’s criteria for safety design of such systems immediately be agreed upon 
and provided to current or future COTS providers. 

As a minimum, the ASAP believes that NASA should begin a dialogue with the 
funded COTS partners to address requirements for human rating. Additionally, 
NASA needs to clarify how much or how little they will be involved in the design, 
approval and operation of the NASA-crewed vehicles in order to verify that the 
funded COTS partners are compliant with the human rating requirements. The 
ASAP recommends the agency be “hands-on.” 

NASA has indicated that they are considering a tiered or stair-step approach in 
addressing the technical review and approval processes to confirm safe flight and 
operational readiness, starting first with some level of technical insight for the un- 
manned services for routine supplies, then with greater insight for unmanned serv- 
ices involving high-valued cargo, and finally building up to the technical insight and 
process to be used for a NASA-crewed COTS mission. In modeling the COTS tiered 
technical insight processes, NASA will use its experience gained in the ISS program 
for transfer of routine supplies, and in the launch services program for commercial 
Expendable Launch Vehicle launches of high valued payloads. The ASAP concurs 
with this methodology. 

Finally, as part of the launch certification requirements, NASA should imme- 
diately identify the number of launch successes that COTS partners will need to 
achieve with the unmanned vehicle in order to demonstrate the required vehicle re- 
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liability for a NASA-crewed launch. In developing the criteria for manned launch 
vehicle certification, NASA may also need to address whether and how the success- 
ful flights and results from the COTS ISS cargo reservicing and NASA launch serv- 
ices programs, can provide evidence for consideration in assessing launch reliability 
for NASA-crewed vehicle. 

Chairwoman Giffords, I would be happy to respond to any questions you or the 
other members of the Subcommittee may have. 

Chairwoman Giffords. Thank you, Mr. Marshall. It is good to 
have you back. 

Mr. Alexander. 

STATEMENT OF BRETTON ALEXANDER, PRESIDENT, 
COMMERCIAL SPACEFLIGHT FEDERATION 

Mr. Alexander. Chairwoman Giffords, Ranking Member Olson, 
distinguished members of the Subcommittee, thank you for the op- 
portunity to testify this morning on behalf of the 20 member orga- 
nizations of the Commercial Spaceflight Federation. We appreciate 
the Committee’s longstanding support of commercial space. 

Commercial crew transportation is complementary, not competi- 
tive, with NASA’s mission and it is crucial to the future of our Na- 
tion’s human spaceflight program for several reasons. First, after 
shuttle retirement, the United States will not have the capability 
to launch humans into space for likely six to seven years. Entering 
this gap, we will send billions of dollars overseas as we purchase 
seats on Russian vehicles at $51 million a seat and rising. A com- 
mercial crew can help prevent future Russian price increases, pre- 
serve redundant access to the space station and potentially shorten 
the gap. Second, enhanced commercial spaceflight will allow us to 
more fully utilize the space station, which is just now being com- 
pleted. Third, commercial missions to low earth orbit will allow 
NASA to focus its resources and expertise on exploration beyond 
low earth orbit. 

Commercial crew has been endorsed by a long line of Presidents 
and Congresses from the 2004 Vision for Space Exploration to the 
2005 and 2008 NASA Authorization Acts. As such, it should come 
as no surprise that the Augustine committee stated, “There is little 
doubt that the U.S. aerospace industry has the technical capability 
to build and operate a crew taxi to low earth orbit.” 

Just as important, the committee stated their unequivocal belief 
that commercial spaceflight could be done safely. Indeed, safety is 
paramount to everyone in this industry. A group of 13 former 
NASA astronauts recently wrote in the Wall Street Journal that 
“We believe that the commercial sector is fully capable of safely 
handling the critical task of low earth orbit human transportation.” 

A taxi service to low earth orbit is a less difficult, more narrowly 
focused mission than the Orion Crew Exploration Vehicle and can 
therefore have more robust margins. For these reasons, commercial 
vehicles can be more cost-effective for Space Station operations 
without sacrificing safety. 

In order to meet stringent safety goals, NASA and industry must 
agree upon a detailed, thoughtful plan. The commercial spaceflight 
industry believes the following four principles are key. First, dem- 
onstrated reliability through a robust test program is crucial. Ro- 
bust testing throughout development and production is necessary 
to demonstrate confidence in the overall system. Commercial crew 
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systems will only begin crewed flights once reliability has been 
demonstrated through multiple successful test flights without crew. 
Demonstrated launch reliability is essential for overall safety. The 
Atlas family, for example, has had over 90 consecutive successes. 
The Atlas V has a perfect record of 19 successful launches. And the 
Falcon 9 will have launched more than a dozen times for cargo and 
satellite missions before crew missions begin. 

Second, robust safety will require additional human rating of the 
launch vehicle and a reliable crew escape system to protect the 
crew in the event of a launch vehicle anomaly. 

Third, clear safety standards and requirements are crucial. It is 
vitally important that NASA and industry agree on the safety re- 
quirements up front and this dialog must begin in earnest now. 
NASA’s human rating requirements document will serve as a start- 
ing point for this dialog but must be tailored for commercial sys- 
tems just as it is for NASA-developed vehicles. NASA is currently 
reviewing their applicability to commercial systems and the com- 
mercial spaceflight industry is also conducting a similar review. 

Finally, let me address government oversight. Any commercial 
crew program must be conducted under the current regulatory re- 
gime established by law, namely FAA licensing. FAA licensing is 
important to ensuring a consistent regulatory regime for both gov- 
ernment and commercial missions, which is key to attracting pri- 
vate investment and non-NASA customers. While the FAA would 
retain the overall licensing authority, NASA would maintain over- 
sight as the customer. In particular, NASA would establish astro- 
naut safety requirements in consultation with industry, establish 
mission-unique requirements such as crew capacity and require- 
ments for space station docking, and most importantly, have final 
approval authority over the launch of NASA astronauts, which 
would be granted only after NASA is satisfied that the vehicle is 
safe, just as NASA does for today’s shuttle missions. 

In conclusion, we firmly believe that NASA and commercial in- 
dustry can and must work together to develop safer human 
spaceflight capabilities. We must begin that dialog now. 

Thank you for the opportunity to be here today and I look for- 
ward to your questions. 

[The prepared statement of Mr. Alexander follows:] 

Prepared Statement of Bretton Alexander 


Introduction 

Chairwoman Giffords and distinguished members of the Space and Aeronautics 
Subcommittee, thank you for the opportunity to testify. I am pleased to be here. 

The Commercial Spaceflight Federation is an association of 20 leading businesses 
and organizations working to make commercial human spaceflight a reality. Our 
members include developers and operators of orbital spacecraft, suborbital space- 
craft, and the spaceports from which they fly. Our membership also includes product 
and service providers for human spaceflight training, medical, and life support 
needs. Our mission is to promote the development of commercial human spaceflight, 
pursue ever higher levels of safety, and share best practices and expertise through- 
out the industry. One goal of all of our member organizations is to greatly increase 
the number of people that fly into space, generating new economic activity here on 
Earth. 

Significant investment has already been committed to the development of com- 
mercial human spaceflight. According to a recent survey done by The Tauri Group, 
$1.46 billion in investment has been committed to commercial human spaceflight ac- 
tivities to date. Coupled with the more than $500 million in development funding 
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provided by NASA under the Commercial Orbital Transportation Services, or COTS, 
program, more than $2 billion has been pledged for the development of commercial 
spaceflight capabilities. I want to take this opportunity to thank the Congress and 
NASA for your support of the COTS program. 

In my testimony today, I will address the safety and oversight questions relating 
to commercially procured crew services. In order to understand these issues, it is 
important to first discuss the context of commercial spaceflight. My testimony covers 
the following key topics: 

Summary of Key Points 

1. Commercial crew transportation to Low Earth Orbit (LEO) is a goal en- 
dorsed by the Vision for Space Exploration (2004), the Aldridge Commission 
(2004), the 2005 NASA Authorization Act, the 2008 NASA Authorization Act, 
and the Augustine Committee. 

o Commercial crew is complementary, not competitive, with NASA activi- 
ties, as commercial crew transportation to LEO will allow NASA to focus 
its unique resources on the more difficult task of beyond LEO explo- 
ration. 

o After shuttle retirement, the United States will send hillions of dollars 
overseas to purchase seats on Russian vehicles during the gap in U.S. 
government launch capability. Only commercial crew allows us to reduce 
the gap, prevent future Russian price increases, and preserve redundant 
access to the Space Station. 

2. Safety is paramount for the commercial spaceflight providers. Indeed, com- 
mercial vehicles such as Atlas V and Delta IV, developed with substantial 
private funding and engineering expertise, are already trusted to launch key 
government national security assets upon which the lives of our troops over- 
seas depend. 

3. Since computer calculations of vehicle safety cannot account for most of the 
root causes of accidents historically, such as human error or design flaws, 
and since even reliable vehicles have historically suffered a period of “infant 
mortality,” the commercial spaceflight industry believes that safety must in- 
clude the following: 

o Demonstrated reliability from orbital flight tests of the full system 
o Not placing crews on initial flights, since early flights are historically 
most risky 

o A highly reliable crew escape system 
o Standards-driven design and operations 

4. Industry believes that the safety of commercial spaceflight must be greater 
than that of any vehicle currently in operation today. In addition to the 
FAA’s existing regulatory authority, as codified in U.S. law, industry will 
satisfy customer-specific requirements levied by NASA in partnership with 
industry. This process has already begun with the cooperation of the stake- 
holders involved. 

5. NASA and FAA will be there every step of the way, and will have oversight 
during design, testing, manufacturing, and operations. As codified in existing 
U.S. law, a licensing, rather than certification, regime is appropriate for 
these vehicles. 

Government Beyond LEO, Commereial to LEO 

Support and encouragement for the commercial development of space, including 
commercial space transportation services, has been a cornerstone of civil space pol- 
icy for decades. It has been endorsed by numerous Presidential Administrations and 
Congresses, and by both parties. A quarter-century ago, the law that created NASA, 
known as the Space Act, was amended to specify that NASA is to “seek and encour- 
age, to the meiximum extent possible, the fullest commercial use of space” and “to 
encourage and provide for Federal Government use of commercially provided space 
services and hardware.” Additionally, the Commercial Space Act of 1998 directed all 
agencies including NASA to “acquire space transportation services from United 
States commercial providers whenever such services are required in the course of 
its activities.” 

In 2004, following the Space Shuttle Columbia accident, the Vision for Space Ex- 
ploration (U.S. Space Exploration Policy, National Security Policy Directive-31), an- 
nounced by President George W. Bush on January 14, 2004, directed NASA to: 



60 


o “Develop a new crew exploration vehicle [now called Orion] to provide 
crew transportation for missions beyond low Earth orbit.” 

o “Acquire” — and it’s important to note here the intentional use of the word 
“acquire,” not “develop” — “cargo transportation as soon as practical and 
affordable to support missions to and from the International Space Sta- 
tion.” 

o And again “Acquire crew transportation to and from the International 
Space Station, as required, after the Space Shuttle is retired from service.” 

o To put further emphasis on this point, the policy directed NASA to “Pur- 
sue commercial opportunities for providing transportation and other serv- 
ices supporting the International Space Station . ...” 

This was reinforced by the Aldridge Commission on implementation of the Vision 
which recommended in June 2004 that “NASA recognize and implement a far larger 
presence of private industry in space operations . . . most immediately in accessing 
low-Earth orbit.” 

This fall, the Review of U.S. Human Space Flight Plans Committee endorsed the 
development of commercial crew capabilities as the primary means to transport as- 
tronauts to and from the International Space Station. Astronaut Sally Ride, a mem- 
ber of the Committee, stated, “We would like to be able to get NASA out of the busi- 
ness of getting people to low Earth orbit.” 

Given the above history, the Augustine Committee’s endorsement of the develop- 
ment of commercial crew capabilities should come as no surprise. Commercial crew 
and cargo to the Station has always been part of the Vision for Space Exploration, 
which had at its most fundamental core the philosophy that government should ex- 
plore beyond low Earth orbit and the commercial sector should provide transpor- 
tation to low Earth orbit. As such, commercial is complementary to government ac- 
tivities, not competitive. 

Congress has noted the importance of commercial spaceflight as well, as the 2006 
and 2008 NASA Authorization bills endorsed commercial cargo and crew. The 2005 
NASA Authorization Act directed NASA to “work closely with the private sector, in- 
cluding by .. . contracting with the private sector for crew and cargo services, in- 
cluding to the International Space Station, to the extent practicable.” The 2008 
NASA Authorization Act directed NASA to initiate a commercial crew program and 
to fund “two or more commercial entities . . . for a crewed vehicle demonstration 
program.” 

To its credit, NASA has already been acquiring cargo delivery to the Station. 
First, NASA invested $500 million in the development of two commercial systems, 
with additional investment contributed by the companies themselves, through the 
Commercial Orbital Transportation Services (COTS) program. After several years of 
development, NASA demonstrated its confidence in the commercial cargo sector by 
declining to purchase additional Russian cargo flights after 2011 and instead award- 
ing over $3 billion in domestic Commercial Resupply Services (CRS) contracts for 
Space Station cargo. In just four years, commercial cargo has transitioned from a 
small initiative to a program that is crucial to the continued existence of the Space 
Station. The bottom line is that commercial space services are on the critical path 
for cargo to the Station and NASA has a vested interest in its success. 

With commercial cargo now on the critical path for the Space Station, it is time 
to consider the value of commercial crew services for Space Station as well. 

Commercial Crew is Essential to Mitigate the Gap 

Despite having an option for crew transportation in the COTS program — the so- 
called Capability D option — NASA has not yet invested in the development of full 
commercial crew capabilities, opting to prove out cargo services first with the possi- 
bility of crew later. The case for beginning a commercial crew program has grown 
stronger in the years since the COTS cargo program began: 

o Flights of the Atlas, Delta, Falcon, and other vehicles have helped ma- 
ture the capabilities that will be needed during a future commercial crew 
program; 

o Commercial companies have invested their own internal R&D and study 
money to explore commercial crew; 

o NASA’s $60m CCDev program is revealing the strength of interest in 
commercial crew by both large and medium-sized companies in the aero- 
space industry; 
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o And the Augustine Committee notes that “the use of commercial vehicles 
to transport crews to low-Earth orbit is much more of an option today 
than it might have been in 2005.” 

Today, three years after the award of the COTS Space Act Agreements (SAAs), 
we no longer have the luxury of time. The Space Shuttle will be retired next year, 
or shortly thereafter, while the first flight of Ares I and Orion has slipped to at least 
2017, according to the Augustine Committee. In fact, the Committee added that if 
the Space Station is extended to 2020 as seems likely, the first human launch of 
Ares I would slip further, even if NASA receives the extra money the Committee 
recommended. As a result, we will be dependent on the Russians for crew transpor- 
tation to the International Space Station for at least five years, if not longer. 

Given that Ares I/Orion is not likely to be ready until at least 2017 and that sys- 
tem is optimized for the unique requirements of exploration beyond Low Earth 
Orbit, we believe a vibrant U.S. commercial crew program is essential for avoiding 
a sole-source reliance on the Russian Soyuz vehicles in the interim. In fact, we have 
already purchased rides on Russian Soyuz spacecraft at the price of $51 million per 
seat, having taken extraordinary measures and changing U.S. nonproliferation laws 
to allow these pa 3 mients. Buying crew services from U.S. industry should not be 
viewed as nearly so extraordinary. 

Moreover, Russia’s prices are rising and are certain to increase once we become 
totally reliant on tbem. A robust U.S. commercial crew program, however, will apply 
competitive pressure on Russia to keep costs down. Also, NASA’s ability to purchase 
Soyuz vehicles from Russia expires in 2016. Ares/Orion is not likely to be ready by 
then. It is impossible to know with certainty whether another extension of INKSNA 
(Iran, North Korea, and Syria Nonproliferation Act) will be granted by Congress at 
that time. Pursuing a commercial option to meet near-term needs for Station could 
help alleviate the risks inherent in Russian reliance. By not pursuing commercial, 
it is almost certain Congress will have to re-address the INKSNA issue. 

Complementary, Not Competitive 

Commercial crew is complementary, not competitive with NASA’s exploration pro- 
gram. NASA should once again be focused on exploration beyond low Earth orbit, 
and turn over to the private sector the repetitive tasks of resupplying the Station — 
and that includes transporting people there too. Not just a few people, but a mul- 
titude of researchers, engineers, and technical specialists. We need more activity in 
low Earth orbit, not less. 

Exploration beyond low Earth orbit will not be sustainable — if it happens at all — 
without a vibrant commercial sector providing transportation services to and from 
low Earth orbit. The Center for Strategic and International Studies recently re- 
leased a report on the U.S. space program which stated: “Without commercial en- 
gagement, exploration will . . . continually expand the scale of government obliga- 
tions, rather than keeping eivil space programs focused on the frontiers of explo- 
ration.” None of us believes that the government can continuously expand the obli- 
gations and expectations of our civil space program without reaching a breaking 
point, regardless of where one thinks that breaking point is. The additional re- 
sources and capabilities of the private sector are essential. 

Commercial to LEO is Less Difficult than Exploration Beyond LEO 

The Augustine Committee, like the Aldridge Commission before it, found that the 
commercial sector is ready and capable to handle the task of transportation to Low 
Earth Orbit. Low Earth Orbit is less difficult, and therefore more achievable by the 
private sector, compared to the more capable tasks that NASA’s current exploration 
vehicles are optimized for. 

Thus, it is not an apples-to-apples comparison to compare a commercial crew ca- 
pability to the Orion crew exploration vehicle. Rather, it is apples and oranges, be- 
cause transporting crew to and from the International Space Station requires a far 
less complex spacecraft than exploring beyond low Earth orbit. It is akin to devel- 
oping a Gemini spacecraft for low Earth orbit, rather than an Apollo spacecraft for 
reaching the Moon. The Orion spacecraft, for example, must reenter the atmosphere 
at one-and-a-half times orbital velocity, encountering heat loads nearly double those 
when returning from low Earth orbit, and Orion must do so with far more precision. 
Orion must also operate autonomously in lunar orbit untended while astronauts ex- 
plore the surface, acting more like a space station than a crew taxi, and requiring 
more complex onboard vehicle systems. 

As a result, the Orion spacecraft is a 25 metric ton (mT) vehicle, whereas space- 
craft designed solely for low Earth orbit transportation are expected to be in the 8- 
12 mT range, or less than half the size for the same number of crew. Quite simply. 
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you don’t take an 18-wheeler to the corner grocery store. Nor do you drive a For- 
mula One racecar. The Orion crew exploration vehicle is, in fact, far more capability 
than is needed to go to and from the Space Station. 

Because it serves a simpler mission, any vehicle that is designed simply to service 
the Space Station — and not go beyond — should be faster and more cost effective to 
develop without sacrificing safety, regardless of whether it is a government or com- 
mercial capability. The Gemini spacecraft, for example, was developed in just under 
2 1/2 years, and had a perfect crew safety track record. 

Regardless of the extent to which “the gap” can be reduced, a spacecraft designed 
solely for low Earth orbit transportation will be more cost effective to operate and 
require smaller launch vehicles. The result will be more frequent missions to the 
Station, increased research and other utilization of the Station, and more resources 
available for exploration beyond low Earth orbit. 

Implementing a Commercial Crew Program 

In light of all the considerations above, the Augustine Committee outlined a $2.5- 
3.0 billion fixed-price Commercial Crew program, in which NASA would invest in 
multiple private companies, each of which would also be required to invest their 
own funds, thereby putting their own “skin in the game.” The committee also sug- 
gested that NASA fund human rating of a proven U.S. launch vehicle to mitigate 
the dependence on the development of new launch systems in addition to the space- 
craft themselves. 

A Commercial Crew program of $2. 5-3.0 billion over 5 years should be sufficient 
funding. For example, one major aerospace company conducted a study that con- 
cluded they could develop a commercial capsule to transport crew to low Earth orbit 
and human rate an existing U.S. launch vehicle for around $1 billion. As another 
example, SpaceX has an unfunded option in its COTS Agreement for $308 million 
to upgrade its Dragon spacecraft to carry crew to and from the Station. Dem- 
onstrating the diversity of interest and capability, the Augustine Committee re- 
ceived price estimates from, according to the report, “five different companies inter- 
ested in the provision of commercial crew transportation services to low-Earth orbit. 
These included large and small companies, some of which have previously developed 
crew systems for NASA.” 

Additional evidence that a Commercial Crew program is viable at $2. 5-3.0 billion 
is again provided by the Gemini program. Despite only having access to 1960s tech- 
nology, and with only a few years of total experience with spaceflight, NASA and 
industry human-rated the Titan II launch vehicle (which required 39 months), and 
designed and tested a crew capsule, for about $2.5 billion in today’s dollars. The 
Gemini program completed all missions safely. 

Since NASA’s budget for the next five years is almost $95 billion, a $2.5 billion 
Commercial Crew program represents less than 3% of total NASA expenditures. 
Clearly, it is not an either/or proposition between commercial crew and NASA explo- 
ration. Commercial vehicles will not have the capability to go beyond low Earth 
orbit, while NASA must develop the capability to conduct exploration beyond low 
Earth orbit. 

To promote competition and innovation, NASA’s investment in a Commercial 
Crew program should be structured using milestone-based, fixed-price agreements 
as it is in the COTS program, unlike traditional cost-plus contracts. The COTS 
Cargo program has shown the wisdom in this approach. NASA initially selected two 
winners, SpaceX and Rocketplane-Kistler, rather than putting all of its eggs into 
one basket. When Rocketplane-Kistler failed to raise the capital to meet its mile- 
stones under its Space Act Agreement with NASA, NASA terminated its funding, 
held a new competition, and had 85 percent of the funding left over to give to the 
new winner, Orbital Sciences. This “portfolio approach” diversified the risk to 
NASA, greatly enhancing the likelihood that NASA will get the expected level of ca- 
pability that it needs. 

Safety of Commercial Human Spaceflight 

Let me now address the safety of commercial human spaceflight systems. Safety 
is paramount. Private companies understand that they will not be in business if the 
systems they develop are not safe. In fact, private industry recognizes that it must 
increase safety from that demonstrated in the past in order to fulfill its vision of 
greatly increasing human activity in space. I believe industry has a healthy respect 
for the limits of their knowledge when it comes to safety. They do not presume to 
know it all and they maintain a strict discipline of safety. At the same time, they 
bring fresh eyes and insights from other cultures and I believe this will ultimately 
enhance safety. 



63 


Human spaceflight is an inherently risky endeavor. This has been true for govern- 
ment human spaceflight and will also be true for commercial. Working in partner- 
ship with NASA, U.S. industry firmly believes it can develop the capability to trans- 
port crew to low Earth orbit safely. Last month, 13 former NASA astronauts ^ en- 
dorsed commercial human spaceflight in a statement in the Wall Street Journal. 
This group of astronauts are highly experienced with spaceflight — collectively, they 
have flown a total 42 space missions and logged a total of 2 years and 48 days in 
space flying six different spacecraft including Gemini, Apollo, Space Shuttle, Soyuz, 
Mir, and the International Space Station. They stated: 

“As astronauts, we know that safety is important. We are fully confident that the 
commercial spaceflight sector can provide a level of safety equal to that offered 
by the venerable Russian Soyuz system, which has flown safely for the last 38 
years, and exceeding that of the Space Shuttle. Commercial transportation sys- 
tems using boosters such as the Atlas V, Taurus II, or Falcon 9 will have the 
advantage of multiple unmanned flights to build a track record of safe oper- 
ations prior to carrying humans. These vehicles are already set to fly over 40 
flights to orbit in the next four years.” 

Working together, NASA and the commercial industry can develop the capabilities 
to safely conduct human spaceflight. NASA and industry must begin the dialogue 
now on the requirements, standards, and processes necessary to make this success- 
ful for all involved. Agreement on the requirements is essential to the success of any 
partnership between NASA and the commercial sector. 

There are several important factors to keep in mind when discussing the safety 
of commercial crew vehicles: 

Commercial Spaceflight Has a Demonstrated Track Record 

First, when we discuss commercial spaceflight, some tend to think of an activity 
in the future. In fact, commercial spaceflight occurs right now and has for years. 
Currently, the Atlas V and Delta IV launch vehicles — both commercially developed 
with substantial private funding — are used to launch multi-billion dollar national 
security payloads upon which the lives of our troops overseas depend. These vehicles 
are also entrusted by NASA to handle some of the most safety-critical applications 
in the civil space sector. For example, the Atlas V is Category 3 certified by NASA 
for launch of NASA’s most critical payloads, and is also certified for launch of nu- 
clear payloads, such as NASA’s New Horizons spacecraft to Pluto, launched with ra- 
dioactive plutonium onboard. 

Not only is the commercial spaceflight sector real, but it has an extensive history 
of successful flights to orbit: the Atlas and Delta families of rockets, many of which 
were developed with substantial private investment and serve multiple customers, 
have a combined record of 114 consecutive successful flights since 2000. The Atlas 
V, for instance, has had 19 consecutive successful flights since its inception. 

We must now turn our efforts to extending this demonstrated track record and 
depth of operational experience to human spaceflight. Fortunately, commercial 
human spaceflight to LEO will not require the development of new launch vehicles. 
Instead, it can be accomplished using existing launch vehicles and those currently 
under commercial development, such as the Atlas V, Falcon 9, and Taurus II launch 
vehicles. This will allow us to leverage our existing track record. 

I will now examine some of the key requirements for ensuring the safety of com- 
mercial spaceflight, and explain how the commercial spaceflight sector can meet 
these high standards. 

Key Requirements for Commercial Spaceflight Safety 

Since computer calculations of vehicle safety cannot account for most of the root 
causes of accidents historically, such as human error or design flaws, and since even 
reliable vehicles have historically suffered a period of “infant mortality,” the com- 
mercial spaceflight industry believes that safety must include the following: 

o Demonstrated reliability from orbital flight tests of the full system 
o Not placing crews on initial flights, since early flights are historically 
most risky 

o A highly reliable crew escape system 
o Standards-driven design and operations 


^The astronaut signatories were Buzz Aldrin, Ken Bowersox, Jake Garn, Robert Gibson, Hank 
Hartsfield, John Herrington, Byron Lichtenberg, John Lounge, Rick Searfoss, Norman Thagard, 
Kathryn Thornton, Jim Voss and Charles Walker. 
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I will now consider each of these topics in turn. 

I. Demonstrated Reliability from Orbital Flight Tests: By the time any astro- 
naut climbs onboard a commercial vehicle, including the Atlas V, Falcon 9, and Tau- 
rus 2, each will have had multiple demonstrated successful flights to orbit. For ex- 
ample, SpaceX’s Falcon 9 would likely have more than 15 missions prior to its first 
crewed launch, due to customers such as the COTS Cargo program and satellite 
launches. As the Wall Street Journal astronauts pointed out, the Atlas, Falcon, 
Delta, and Taurus systems combined have over 40 more missions on the manifest 
before 2014, in addition to numerous flights of commercial systems that have taken 
place before this year. 

Human-rating of existing launch systems will cost money, and care must be 
taken, but as a recent study by The Aerospace Corporation concluded, there are no 
show-stoppers to human rating the existing proven fleet of launch vehicles. Norm 
Augustine pointed out that we did it safely for Mercury and Gemini, when our ex- 
pertise in human spaceflight was much lower than it is today, and we can do it now. 

Demonstrated reliability is so important because computer models and Prob- 
abilistic Risk Assessments (PRAs) are not sufficient to capture the majority of fail- 
ure modes that affect real, flying vehicles — especially vehicles that are flying their 
first few missions. The Augustine Committee, which included two experienced astro- 
nauts, pointed out the following on PRAs: 

“Studies of risk associated with different launch vehicles (both human-rated and 
non-human-rated) reveal that many accidents are a result of poor processes, 
process lapses, human error, or design flaws. Very few result from so-called ran- 
dom component failures. The often-used Probabilistic Risk Assessment (PRA) is 
a measure of a launch vehicle’s susceptibility to these component or system fail- 
ures. It provides a useful way to compare the relative risks of mature launch ve- 
hicles (in which the design is well understood and processes are in place); it is 
not as useful a guide as to whether a new launch vehicle will fail during oper- 
ations, especially during its early flights.” 

Probabilistic Risk Assessments and computer models are useful tools, but they 
have limitations. While the commercial spaceflight industry will make use of every 
tool that is available to improve safety, computer models are just one tool among 
many. Demonstrated reliability and a robust flight test program are crucial. Reason- 
able minds can differ on how many successful launches is sufficient before putting 
people on top, but there is no debate that more is better. 

At this point, let me briefly address two myths surrounding the safety of commer- 
cially procured crew transportation systems. First, some have claimed that commer- 
cial crew systems will only be able to produce cost savings for NASA by cutting cor- 
ners and being less safe. In fact, commercial crew systems are cheaper for a dif- 
ferent reason — because they have a less ambitious mission than systems designed 
for exploration. Since commercial LEO systems are simply tackling a less difficult 
challenge, commercial crew will be able to achieve cost savings for Space Station 
missions without cutting any safety corners. By focusing on a less ambitious mission 
that requires less capable vehicle performance, the commercial spaceflight industry 
is following a statement of the Columbia Accident Investigation Board that “the de- 
sign of the system should give overriding priority to crew safety, rather than trade 
safety against other performance criteria.” 

Second, some have claimed that NASA’s Exploration Systems Architecture Study 
(ESAS) shows that the current exploration vehicles are safer than commercial crew 
vehicles. In actuality, commercial crew vehicles were never even analyzed in the 
ESAS report — the ESAS report only looked at vehicles large enough to carry Orion, 
such as Ares I and variants of the triple-core Delta IV Heavy, and did not examine 
the smaller, simple, single-core vehicles, such as Atlas V Medium and Falcon 9 Me- 
dium that are sufficiently sized for commercial crew missions. Moreover, even if 
ESAS had compared exploration vehicles to commercial crew-sized vehicles, the 
comparisons would be “apples vs. oranges,” because of the dramatically different 
tasks of these two types of vehicles. 

II. Not Risking Crew During Initial Flight Tests: Historical records show that 
even reliable vehicles, such as the Soyuz, initially go through a period of lower reli- 
ability (“infant mortality”) as design flaws are caught and corrected. The use of 
proven launch vehicles enhances safety by using a mature system with a dem- 
onstrated track record that has gone through the infant mortality stage experienced 
by most new launch systems. 

By leveraging the cargo and satellite flights, such as the COTS Cargo flights, that 
precede the first crewed flights, the commercial sector can help ensure that tbe in- 
fant mortality phase does not risk human lives. Commercial providers are free to 
pursue multiple customers, such as NASA science missions, national security mis- 
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sions, or commercial satellite missions, to help extend and strengthen the crucial 
test flight phase before humans are launched. Again, reasonable minds can differ 
on how many test flights are needed in light of infant mortality, but all can agree 
that it is good that the commercial sector can leverage non-crewed flights, such as 
cargo and satellite launches, to help alleviate crew risks associated with flying dur- 
ing the infant mortality phase. 

III. A Robust Crew Escape System: In addition to demonstrated reliability of 
the launch vehicle, ascent safety will be based on an emergency detection system to 
detect any anomalies during launch and a crew escape system to separate the space- 
craft from the launch vehicle in the event of an anomaly. 

The commercial spaceflight industry understands that safety requires not just a 
reliable launch vehicle, but an integrated system with robust crew escape capabili- 
ties. As the Augustine Committee notes, “It is unquestionable that crews need ac- 
cess to low-Earth orbit at significantly lower risk than the Shuttle provides. The 
best architecture to assure such safe access would be the combination of a high reli- 
ability rocket and ... a launch escape system.” The commercial spaceflight indus- 
try is committed to meeting this combination. 

rV. Effective Government Oversight: Human spaceflight is now almost 50 years 
old with the first flights of Alan Shepard and John Glenn occurring before I was 
born. It is time to transition access to low Earth orbit to the private sector so NASA 
can once again lead exploration beyond. Nevertheless, NASA and the FAA will be 
involved in every step of a Commercial Crew Program. In fact, every human space- 
craft to date has been developed in partnership between NASA and U.S. industry, 
and this will also be true for a Commercial Crew Program. I will now address this 
crucial topic in more detail. 

First, any NASA Commercial Crew Program must be conducted under the current 
regulatory regime established by law, namely, licensing by the Federal Aviation Ad- 
ministration (FAA) Office of Commercial Space Transportation. FAA licensing of 
commercial spaceflight activities is established by law, requires a high degree of sys- 
tem safety, and provides a stable and predictable regulatory environment necessary 
for the success of commercial human spaceflight businesses. As codified in existing 
U.S. law, a licensing regime, rather than a certification regime, is appropriate for 
these vehicles. 

While the FAA would retain overall licensing approval authority, NASA would 
maintain strong oversight as the mission customer. As with today’s commercial ex- 
pendable launches, the customer has go/no-go authority over the readiness of the 
mission and, therefore, NASA would maintain its role as safety approval authority 
for its crew onboard any commercial vehicle. NASA-unique requirements would be 
imposed as customer requirements, rather than as the overall regulator of the com- 
mercial spaceflight activity. (This is discussed in more detail in the next section.) 

While it is appropriate for NASA to establish customer-specific requirements, an 
entirely new licensing or regulatory regime, separate from the current FAA regime, 
should not be established for NASA or any other entity that would require compli- 
ance with different rules and regulations for commercial human spaceflight services 
provided for U.S. Government and commercial customers. The creation of a NASA- 
specific regulatory regime would impose parallel regulatory and operating environ- 
ments for commercial operations for private customers and “commercial” operations 
for NASA. A two-track regulatory environment could hurt industry’s ability to ob- 
tain non-NASA customers, impacting business viability by lowering the total num- 
ber of flights. Such a situation would be the opposite of the more robust flight his- 
tory and greater operational experience that is crucial to enhance safety. 

NASA Will Be There Every Step of the Way 

In any Commercial Crew program, NASA will play a pivotal role in the design, 
development, and operation of the commercial vehicles. NASA will be there every 
step of the way. In particular: 

o NASA, in consultation with industry, will establish baseline human 
spaceflight safety requirements. That dialogue must begin now. 

o NASA will also establish its mission-unique requirements, such as crew 
capacity; ability to dock with the International Space Station, including 
meeting visiting vehicle requirements; and functionality as a crew rescue 
vehicle, among others. 

o And NASA will have final approval authority over the launch of NASA 
astronauts on commercial vehicles, which would be granted only after 
being satisfied that the vehicle is safe for launch, just as it does for to- 
day’s Space Shuttle missions. 
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Whether or not these safety requirements are the same as those found in NASA’s 
current human-rating requirements document (NPR 8705.2B) is currently under 
consideration. NASA is reviewing its human-rating requirements as they would be 
applied to commercial human spaceflight capabilities. This is the right thing for 
NASA to do and I applaud them for doing so. 

In fact, there is already a precedent for reviewing human-rating requirements. 
During the Constellation Program, NASA revised its human-rating requirements 
document in May 2008, going from the original version A to the current version B. 
Based on the judgment of NASA engineers, version B revised some requirements re- 
lated to structural safety margins and dual-fault tolerance. In fact, no existing U.S. 
spacecraft — or Russian, for that matter — has ever met all of NASA’s human-rating 
requirements, but rather have obtained waivers to certain requirements. These ex- 
amples demonstrate the importance of early dialogue between NASA and the com- 
mercial spaceflight sector on the nature of human-rating requirements for commer- 
cial systems, with demonstrated reliability, robust test flights, and a reliable crew 
escape system being key. 

While NASA is conducting its review, U.S. industry is also conducting a similar 
review. We have established a Commercial Orbital Human Spaceflight Safety Work- 
ing Group. While the Commercial Spaceflight Federation has taken the lead in orga- 
nizing the effort, the working group includes representatives from a broader spec- 
trum of companies, including several of the major aerospace primes and more tradi- 
tional government space contractors. The goal of the effort is to develop industry 
consensus on principles for safety of commercial orbital human spaceflight. So far, 
we have met among industry and have begun to engage NASA and the FAA. There 
is much more work to be done. However, consensus has been reached among a num- 
ber of companies on principles with other companies currently reviewing the docu- 
ment. Regardless, it has already been useful in illuminating the issues and differing 
perspectives of those involved and is an important step in the right direction. 

Finally, I note that industry and NASA standards will include more than just the 
launch vehicle. For example, once in orbit, spacecraft must rendezvous with the 
Space Station, dock or berth with it, and then undock and de-orbit, reentering the 
atmosphere and landing safely back on Earth. The technologies to rendezvous and 
dock with the Station have been demonstrated by the United States, Russia, Europe 
and Japan. Working in partnership with NASA, Europe and Japan demonstrated 
these capabilities this year, and NASA is working with SpaceX and Orbital Sciences 
here at home to demonstrate the same capabilities under the COTS Cargo program. 
Examples such as these illustrate the importance of cooperation between the private 
sector and NASA to ensure safe operations. 

Conclusion: A Partnership Between NASA and U.S. Industry 

The discussion of standards brings me to one of the most important prerequisites 
for success of any Commercial Crew Program — how NASA engages with the private 
sector is ultimately as important, if not more important, than the amount of funding 
provided. NASA’s COTS Cargo program is an excellent example. While some were 
initially resistant to commercial resupply of the Station, once it became a necessity 
NASA engaged the private sector in true partnership in order to ensure that the 
capability is available as soon as possible. 

I have every confidence that we are at such a turning point with Commercial 
Crew as well. It is now a necessity, and I believe that NASA and industry will both 
step up to make it happen. 

Thank you for the opportunity to be here today and I look forward to your ques- 
tions. 

Chairwoman Giffords. Thank you, Mr. Alexander. 

Dr. Fragola. 

STATEMENT OF JOSEPH FRAGOLA, VICE PRESIDENT, 
VALADOR, INC. 

Mr. Fragola. Madam Chairwoman and distinguished members, 
it is an honor to be able to be before you today, and I would like 
to share with you some of the experience that I have had in the 
form of four simple laws for a safe space launcher design. 

The first law has been referred to before, and that is to make the 
design as inherently safe as possible. That involves two important 
aspects: first, to make the launcher reliable, and second, and this 
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is four times not mentioned in discussion, to make sure that the 
failure modes of the launch vehicle present a benign environment 
to the abort system. This is so important I would like to repeat it: 
to assess the vehicle to make sure that the abort modes given a 
failure represent a benign environment for the system for escape. 
Second, separate the crew from the source of failure as far as pos- 
sible in the design, or as I like to say, put them on top where God 
meant them to be. Third, establish a credible abort trigger set, and 
in doing so, balancing the warning time available with the threat 
of false positives against the G load on the crew. Fourth, include 
an abort system that is tested and verified for robustness to allow 
for a safe crew escape and recovery. 

I would mention that from my experience, the Ares I vehicle is 
the singular vehicle that has been designed from the very moment 
of its conception with safety in mind. What I mean by that is that 
other launches, for example, have emphasized launch reliability 
but investigation of subsequent two accident conditions allowing for 
abort is something they usually don’t address, and the reason for 
it is very simple. They are interested primarily in payload to orbit. 
When a payload fails, the subsequent conditions are no matter to 
the person who pays for the payload. When a crew launcher fails, 
the conditions subsequent to that launch failure are important to 
the payload, which is the crew. 

We hope that the alternatives to the Ares I will follow the re- 
mainder of the rules that we mentioned, but in most of the lit- 
erature discussing it, the importance of an abort system and the 
testing of an abort system independent of the number of experi- 
ences of the launcher has not really been addressed. Many times, 
for example, we speak of successes in terms of maybe 19 successes 
of the Atlas V, which is a credible, wonderful, reliable record but 
I will remind the Subcommittee that the space shuttle had 25 suc- 
cesses prior to the Challenger accident. 

One of the things to remember in the design of a new launch ve- 
hicle or the application of an existing launch vehicle to crew is to 
understand that invariably in modifications of designs or the devel- 
opment of new designs we have an issue of reliability growth. Im- 
mature designs need time to become mature, and that is why the 
abort system testing and integration into the design and the benign 
nature of the failure initiators is extremely important for a crewed 
launcher. 

Now, as was mentioned, we did an independent assessment of 
the Ares on an apples-to-apples comparative basis to all the other 
alternatives we were provided, and I showed this on a slide that 
is presented there. On a comparative basis, you can see that from 
the standpoint of loss of crew, the Ares vehicle is somewhere be- 
tween two to three times safer than all the alternatives, in some 
cases more than three times safer than the alternative vehicles. If 
we look at this, people often mention yes, but there is a certain 
amount of uncertainty, there certainly is uncertainty but even with 
the uncertainty taken into consideration, the loss of crew benefits 
from the Ares I vehicle are significant above the alternatives. The 
reason for it is not only its inherent reliability in the first stage 
proven in 255 successful shuttle launches but also the nature of a 
solid rocket booster. The predominant failure mode by far is case 



68 


breach, nozzle burn-through or joint burn-through. All of those al- 
ternatives, although they are very significant when combined with 
a single core liquid or a tandem booster in a singular solid rocket 
booster present a rather benign abort environment to launch abort 
system. It is the combination of this inherent reliability and its in- 
herent benign abort conditions that make the Ares I such a safe 
launcher and that is the reason why it was designed from the be- 
ginning in that way. Thank you. 

[The prepared statement of Mr. Fragola follows:] 

Prepared Statement of Joseph R. Fragola 

Madam Chairwoman, distinguished members of the Subcommittee: I want to 
thank you for the opportunity to address you today. My testimony will detail my 
personal perspective on the ongoing focus on safety matters with regard to human 
space flight, focusing primarily on how NASA sought to better safety ratios for the 
Constellation Program via a risk-informed design process whose overriding priority 
has always been and will always be crew safety. 

Introduction 

Risk-based Design for Inherently Safe Crewed Launchers: The design of 
the system [that replaces the shuttle] should give overriding priority to crew safe- 
ty, than trade safety against other performance criteria, such as low cost and 
reusability, or against advanced space operation capabilities other than crew 
transfer. (Columbia Accident Investigation Board (CAIB) Report Section 9.3) 

This quote from the CAIB gives NASA clear direction to the design of the next 
generation crew launch system: make it simple, make it safe, and let the driving 
design principle be crew safety. That is simple enough to say, but how do we design 
for safety from the start? In other words, how do we make it “inherently safe” while 
also protecting against residual risk, in a mass-constrained, highly-energetic system 
such as a launch vehicle? To paraphrase the definition of inherently safe design is 
to say that the principle objective of the design process should be to eliminate, or 
at least reduce to a minimum, the hazards associated with the process so that the 
elimination or reduction is both permanent and inseparable from the design. Once 
a design concept has eliminated or reduced the hazards to a minimum, the design- 
ers can focus on developing acceptable mitigation approaches for the residual risks. 
This process is referred to as a risk-based or risk-informed design. 

NASA has utilized the May 2004 memo from the Chief of the Astronaut Office 
on future system launch safety as guidance in designing for ascent safety. A key 
statement from this memo is. 

The Astronaut Office believes that an order-of-magnitude reduction in the risk 
of loss of human life during ascent, compared to the Space Shuttle, is both 
achievable with current technology and consistent with NASA’s focus on steadily 
improving rocket reliability, and should therefore represent a minimum safety 
benchmark for future systems. This corresponds to a predicted ascent reliability 
of at least 0.999. To ensure that a new system will achieve or surpass its safety 
requirement, it should be designed and tested to do so with a statistical con- 
fidence level of 95%. (Astronaut Office Memo) 

The paragraphs that follow explain how this is being accomplished in the develop- 
ment of what has come to be the Ares I crew launcher and Orion spacecraft, and 
why the current design is believed to be inherently safer and operationally safer 
than alternative design concepts that might be equal in operational capability, or 
in some cases even more capable. The Constellation system is the only launch sys- 
tem that has been specifically engineered to meet the Crew Office memorandum 
guidance of 1 in 1,000 missions loss of crew (LOC). 

The Two Elements of Risk-Informed Design 

In the Apollo era, crewed launchers were fundamentally designed with the best 
level of expertise available, tested to exhaustion, and then robustness or redundancy 
was added to mitigate the residual risk. This redundancy was applied across the de- 
sign and included engine-out capability during at least portions of ascent, launch 
escape capability, a “life boat” vehicle on the way to the Moon, an abort stage possi- 
bility during descent to the lunar surface, and component robustness or redundancy 
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where element redundancy was no longer possible. Reliability and risk-informing 
analyses were primarily qualitative, such as Failure Modes and Effects Analyses 
(FMEAs), which were applied as a check of the design rather than being integral 
to the design development. 

Design development for Constellation, therefore, has consisted of two key tenets 
related to safety. These are to make the design as reliable as possible (inherent safe- 
ty), so that backup systems would never have to be used, and to make the backup 
systems as robust as possible to maximize the likelihood of crew survival and return 
given a failure of the primary system or element. Notice that, in the Apollo era, re- 
dundancy or robustness was not added for mission continuance as it was in the 
shuttle era in some cases at least, but was applied to ensure safe return of the crew. 

Tenet Number 1 — Make the Design Inherently Safe 

As codified in Constellation Program safety policy, inherent safety implies the 
elimination of hazards that have historically been associated with the operation of 
the type of system being designed. This in turn implies the systematic identification 
of the hazards associated with operation of the system alternatives being consid- 
ered. The process of hazard identification is implemented in a global sense by a haz- 
ard analysis, which essentially establishes the potential spectrum of generic hazards 
that might be applicable to a particular design. The hazard analysis also establishes 
a local evaluation of the credibility of these hazards being applicable to the design 
in terms of their likelihood of being activated, as well as the local conditions that 
would determine their consequences if unmitigated. Both the likelihood of activation 
and the associated consequences once activated are established and developed from 
historical data on heritage systems and the combined judgment of design and safety 
experts on how this heritage data applies to each specific design alternative. 

If mission reliability, i.e., inherent safety, were equivalent to crew safety as it is 
for payload “safety,” then the task that would be left to the analysts would be to 
inform the decision makers of the forecasted mission reliability of each design. Even 
in this case, an alternative that employed a first stage that made use of a solid, 
which could subsume the reliability of the shuttle solid, would be a strong contender 
because the shuttle solid has demonstrated a mission reliability of just a single fail- 
ure in approximately 250+ booster firings. This implied demonstrated reliability of 
0.996, or 99.6%, rivals the best of the best of the boosters worldwide. However, in 
the case of crew safety, mission reliability is not the entire story. 

Tenet Number 2 — ^Adequacy of “Abort Effectiveness” 

The shuttle designers, unlike the Apollo designers before them, concentrated fully 
and completely on the inherent safety of the vehicle — that is, they relied on the fore- 
casted mission reliability of the design alone to guarantee crew safety. Clearly, the 
primary focus of a launcher design should be on mission reliability, regardless of 
whether or not it is crewed. The primary objective of the design should always be 
to avoid failure. 

A mitigating system, given a failure, should never be used as a crutch to enhance 
crew safety, but rather only be used as a way to abort the mission and recover the 
crew. However, unless the reliability of the primary design can be assured to a sig- 
nificantly high degree, a mitigating system (such as the Orion Launch Abort Sys- 
tem) is essential to ensuring crew safety. The crew safety enhancing power of an 
abort system is generated by the fact that it provides an additional or conditional 
crew survival probability given the occurrence of a crew threatening event. This con- 
ditional probability of a successful abort and return given a crew-threatening event 
is referred to as the “Abort Effectiveness.” 

The abort effectiveness value is a function of several things: the probability that 
the abort can be initiated in time to allow for a safe distance to be established for 
crew survival with employing an acceleration that also allows for survival, the reli- 
ability of the abort system, and the conditions that the crew vehicle will be obligated 
to negotiate subsequent to the abort initiation. In the days of Apollo, when NASA 
had comparatively little experience and computational capability, the abort effec- 
tiveness was estimated by comparison to escapes from high-performance military 
aircraft combined with the results of a few escape system tests. Little Joe I and II. 

Today, Constellation is systematically applying throughout the design process the 
software simulation tools and advanced computers that allow us to do a much better 
analytic design assessment than Apollo. Specifically, the integrated abort effective- 
ness can now be calculated by employing more realistic simulations of abort condi- 
tions. The integrated abort effectiveness is the effectiveness of each abort against 
each initiated abort scenario weighted by the occurrence probability of the scenario. 
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While simulation tools and computational capability were unavailable in the Apollo 
era, today this calculation can be carried out with reasonable accuracy. 

The value of the abort effectiveness for each acceptable, payload-capable alter- 
native is possible but complicated to determine. However, what is known is that the 
primary determinate of the effectiveness of an abort is the time available to affect 
the abort along with the severity and extent of the environment in the abort locale. 

Top Level Risk-Informed Design Seleetion During ESAS 

The above paragraphs have indicated the importance of incorporating risk evalua- 
tion from the very beginning of the crewed launcher design selection process to 
achieve an overriding priority for crew safety. Without this focus on safety risk eval- 
uation, the crew launcher focus can slip into one emphasizing performance over 
safety. Even with safety as the overriding priority, the launcher must have accept- 
able payload capability and be affordable. Safety risk alone cannot be the criteria 
for the selection of a crew launcher design. Decisions must be made with safety risk 
as a priority, but within the context of a risk, performance, and cost picture. This 
implies that from a top-down perspective, potential crewed launchers should be each 
evaluated on the basis of cost, performance, and risk simultaneously, and this is just 
how the ESAS study efforts for the selection of a crewed launcher design proceeded. 

During ESAS, any launch vehicle concept that did not approach at least 1 in 1,000 
forecasted launch Loss of Crew (LOG) risk was eliminated. In addition, concepts 
that would place the crew module in close proximity to the boosters and/or other 
potential sources of accident initiation were eliminated because it as anticipated 
they would interfere in NASA’s ability to incorporate a launch abort system into the 
next-generation launch vehicles. Lastly, as part of its findings, the ESAS team rec- 
ommended that this risk-informed design process be extended to the development 
of the design of the selected single solid First Stage concept, which would later be 
known as the Ares 1 Crew Launch Vehicle. 

Constellation Safety Story 

The Constellation program baseline was derived directly from the ESAS rec- 
ommendations, and a clear discriminator among crew launch vehicle alternatives 
was the relative complexity of the launcher’s first stage and the effectiveness of the 
crew escape system. 

The Ares I first stage (FS) consists of a 5-segment reusable solid rocket motor 
(RSRM), an aft skirt, a forward skirt, and a frustum. The 5-segment solid is an evo- 
lutionary growth from the 4-segment solid RSRM tandem boosters utilized to power 
the space shuttle. The Ares I booster will continue the protocol of recovery and post- 
flight inspection that began in the Shuttle Program. To summarize, the 5-segment 
solid for the Ares I has many advantages over other designs, including: 

• Drawing extensively from the heritage and knowledge derived from the Shut- 
tle RSRM Program. There have been 252 solids flown in the Shuttle Program 
with one failure (Challenger STS-51L). 

• Applying the knowledge gained from that experience-base to actively improve 
design features. 

• Utilizing extensive qualification and flight test programs. 

• Incorporating a failure-tolerant design against the primary failure modes of 
joint leakage and case burn-through. 

• Incorporating an extensive system of process controls in manufacturing and 
assembly. 

• Benefiting from the basic Ares “single-stick” architecture, which eliminates 
the possibility of engaging elements that are radially or tandem mounted. 

The Orion crew capsule will have a Launch Abort System (LAS) that will offer 
a safe, reliable method of moving the entire crew out of danger in the event of an 
emergency on the launch pad or during entire first stage and the most risk intense 
portion of the second stage climb to Earth orbit. Mounted at the top of the Orion 
and Ares I launch vehicle stack, the abort system will be capable of automatically 
separating the Orion from the launch vehicle and positioning the Orion and its crew 
for a safe landing. NASA plans a series of tests to characterize the LAS. Pad Abort 
(PA)-l, which is planned for March 2010, is the first of these tests and will address 
what happens if an emergency occurs while the Orion and the launch vehicle are 
still on the launch pad. Other such tests will determine how the LAS behaves dur- 
ing critical parts of the flight regime. These tests will take place at White Sands 
Missile Range, New Mexico. 
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NASA is making substantial progress in maturing its approach and design meth- 
odology for designing a robust crew-launch system. From the very onset of the Con- 
stellation Program, the NASA design team insisted on the application of a risk-in- 
formed design approach. That is, safety risk members are included as integral parts 
of the Constellation design team. They are chartered to develop risk-informed ap- 
proaches for the Ares I and Orion design concept refinement, and are included in 
all trade studies that involved safety risk. 

The skill mix of the NASA team includes not only the Failure Modes and Effects 
Analyses, Integrated Hazard, and Probabilistic Risk Assessment (PRA) disciplines 
traditionally found under the Safety and Mission Assurance (S&MA) organizations, 
but also engineers with such backgrounds as computational fluid dynamics (CFD), 
Aerospace, and Physics disciplines. The team functions as a single group entitled 
Crew Safety and Reliability (CSR) and has been given the clear direction to work 
daily with the design engineers to provide expertise and feedback via various assess- 
ments and analysis techniques throughout the design maturation process. This in- 
vestment continuously emphasizes a sincere commitment to the CAIB findings. 

Additionally, the primary modus operandi of past programs has been to provide 
intermittent reviews of design “drops” at the prescribed reviews. This limited mean- 
ingful insight into the systems development, which was occurring in the everyday 
work environment where design risks, nuances, trade studies, etc., are introduced. 
The Constellation approach, by contrast, has fostered the development of a truly 
risk-informed culture on a continuing and synergistic basis. 

In parallel and in concert with the Ares I design development; NASA’s Constella- 
tion team is providing the resources for the development of the supporting logical 
and phenomenological (or physics-based) computer models and associated historical 
data sets. This allows for the identification of all credible potential events that 
might initiate an accident, the extant local external environmental conditions as de- 
termined by aero-physics computer models, and internal conditions, as determined 
initially by judgment and then later by motor and engine physics computer models, 
at the postulated time in the ascent trajectory that initiator was to occur. Then the 
global environment is imposed upon the integrated ascending Ares I stack and on 
the Orion crew module as determined by sophisticated computer models replicating 
those environments seen as potentially assaulting the vulnerabilities of Orion. Spe- 
cifically, fragmentation fields, propagated impulse and pressure fields, and thermal 
radiation fields generated by the accident scenarios are initiated, forming the basis 
of the ‘blast environment’ that the Orion must escape from. 

Currently the Ares I has an estimated AE of about 84%, which when combined 
with its high heritage based inherent reliability makes it two to three times safer 
than alternative launchers as shown in Table 1 and in graphical form in Figure 1. 
This corresponds to a LOM of 1 in 200 in ascent, which leads to LOG of about 1 
in 1300 according to our independent calculations. 
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Meanwhile, examples of cases where the risk assessment and failure analysis 
teams have provided input and/or impacted the outcome of Constellation design 
issues, trades, or risks include the following. 

• Abort triggers study: Provided LOC and Abort Effectiveness assessments, in- 
cluding engineering models and timing, to determine what potentially cata- 
strophic scenarios warrant abort sensors and software algorithms. 

• Separation study (booster deceleration motors (BDMs)): Hazard analysis com- 
bined with probabilistic design analysis (PDA) led to the design decision to 
increase the number of BDMs from 8 to 10. 

• The Hazards Team identified that the first stage and upper stage designs 
failed to meet properly at the interface flange (different number of bolts) and 
a re-design was instituted. Hazards team provided assessment to Upper Stage 
that resulted in clocking of the hydrogen and oxygen vents to improve separa- 
tion distance. 

• Orion and Ares systems architecture trades: risk assessment and failure anal- 
ysis teams have informed the active mitigation of systems design 
vulnerabilities for both the rocket and spacecraft. 

• Failure Modes and Effects Analysis teams: 

o J-2X FMEA was used to support redline sensor selection in order to de- 
tect failure modes prior to their propagation to a catastrophic condition. 

o Upper Stage Main Propulsion System (MPS) FMEA identified need for 
modifications related to solenoid valves to increase reliability and failure 
mitigation. 

o US Reaction Control System FMEA identified need for additional tem- 
perature sensors to detect freezing of hydrazine to support launch com- 
mit criteria. 

o US Flight Safety System (FSS) FMEA identified need to relocate cryo- 
genic helium line that was adjacent to Flight Termination System (FTS) 
linear shaped charge. 

o FS Roll Control System was changed from bipropellant to monopropellant 
due to significant reduction in critical failure modes. 


Summary 

The Constellation design development process has, and continues to employ, a 
continuous risk-informed design process adopted from the outset of the program. 
This process has included both logical and physical simulation models as appro- 
priate in a way that has had a synergistically beneficial impact on Orion and Ares 
I designs by allowing them to be developed with an “overriding priority” given to 
crew safety at every stage of the design and operational processes. I believe that 
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the Constellation development represents a successful, pioneering application of a 
new approach to engineering design, a type of engineering risk design, which will 
have multiple applications and refinements in aerospace system designs in the fu- 
ture. 

Closing 

In closing, I would be remiss if 1 did not bring your attention to a statement from 
the Augustine report that I believe to be problematic. Specifically, on page 9 of their 
report the Committee states: 

Can we explore with reasonable assurances of human safety? Human space trav- 
el has many benefits, but it is an inherently dangerous endeavor. Human safety 
can never be absolutely assured, but throughout this report, safety is treated as 
a sine qua non. It is not discussed in extensive detail because any concepts fall- 
ing short in human safety have simply been eliminated from consideration. (Au- 
gustine 9) 

I believe this statement to be problematic because I believe it to be indicative of 
what I like to call a “goal post” mentality rather than the proper safety mentality 
which should be “As low as reasonably achievable”, or ALAKA. In the former case 
items are considered safe if they meet the criterion, in this case “human safety”, 
or not if they don’t. If they meet the criterion and are considered safe they are re- 
tained, and if they don’t they are considered unsafe and are eliminated from consid- 
eration. It matters not if some alternatives just miss the criterion, or they miss it 
by a mile, they are eliminated nonetheless. And if they just make the criterion or 
they are much better, they are all considered “safe”. While it is certainly true that 
safety cannot be assured in spaceflight and it is also true that the safety level of 
concepts are uncertain this approach has led in the past in other industries, such 
as the commercial nuclear power industry, to a safety perspective that focused only 
on which concepts or designs should be considered safe and which not. In this way 
the safety bar is set to include the lowest acceptable rather than focusing on which 
designs were as safe as achievable. There are always uncertainties in every anal- 
ysis, and risk analysis is no exception. Still when solid, heritage-based analysis 
shows significant differences in safety risk amongst alternatives it is questionable 
how an investigation that claims safety as a sine qua non can fail to highlight these 
discriminations. 

Now it is true that the goal post approach will eliminate design concepts that are 
clearly unacceptable, but it also fails to discriminate designs that are clearly desir- 
able among those that are acceptably safe. It is my belief that the Ares I vehicle, 
because of its inherent focus on being as safe as achievable from the very start, has 
the best chance to be an outstandingly safe crew launcher. There is no way to insure 
safety, and spaceflight will always be a risky endeavor, but a launcher that is de- 
signed to be safe from the start, at least to me, is a good way to begin. 

Madam Chairwoman, I would like to thank you and the members of this Sub- 
committee for the opportunity to express my ideas. I would be pleased to respond 
to any questions that you or the other Members may have. 

Chairwoman Giffords. Thank you, Dr. Fragola. 

General Stafford. 

STATEMENT OF LT. GEN. (RET.) THOMAS STAFFORD, UNITED 
STATES AIR FORCE 

Lt. Gen. Stafford. Chairwoman Giffords, Ranking Member 
Olson, distinguished members of the Committee, many old friends, 
I am honored to be invited here to appear before you today to tes- 
tify on the matter of crew safety in human spaceflight. 

As a result of the Augustine Committee report, it is imperative 
that the information and their observations that resulted in rec- 
ommendations be considered carefully before the Congress directs 
or allows changes to be made to the program that NASA has pur- 
sued and the Congress has approved over the past years. Mr. Au- 
gustine invited me to be the first presenter to the committee due 
to the fact that I presently chair the ISS Independent Advisory 
Taskforce and previously had chaired the Shuttle-Mir Taskforce. I 
had also chaired a yearlong study at the direction of the Vice Presi- 
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dent on how NASA should return to the moon and go on to Mars 
in a safer, better and a more rapid timeframe at a minimum cost. 
The study was titled “America at the Threshold” and Mr. Augus- 
tine provided a copy to all members of the committee prior to that 
first meeting they had. 

After the Columbia accident in 2003, I was asked by the NASA 
Administrator to chair the Return to Flight Task Group to review 
the Columbia Accident Investigation Board recommendations to en- 
sure that these recommendations are carried out by NASA before 
the space shuttle return to light, and today I want to acknowledge 
the work performed by the Augustine Commission that covered 
these broad-based subjects in a relatively short period of time. 
After my own extensive examination of the committee’s reports, I 
strongly agree with the majority of their findings. However, on a 
few I disagree. 

I would strongly agree that the NASA Administrator who is as- 
signed responsibility for the management of NASA needs to be 
given authority to manage the agency. This includes restructuring 
resources, the workforce and facilities to meet the needs. The Au- 
gustine committee has pointed out to some of the underlying con- 
cerns and all the deliberations on the future of U.S. human 
spaceflight program are that NASA has been inadequately funded 
for many years, and on this point I strongly agree. I certainly hope 
that this year a satisfactory appropriations bill for NASA will be 
passed. 

I agree with the committee’s recommendation that the remaining 
space shuttle flights should be launched on a schedule that is com- 
patible with the normal procedures that are used for safe checkout 
and test for launch operations and which may extend to flights into 
2011. We presently have a shuttle at KSC standby on notice for 
rescue if required. If funding were available, this shuttle should 
launch large cargo that could enhance the viability of the ISS six- 
person crew capability. 

The committee wisely recommended the continuation of U.S. par- 
ticipation in the ISS to be extended to 2020. We must remember 
that the United States cannot make a unilateral decision to end 
and deorbit the International Space Station. However, the ISS will 
never be fully and effectively utilized unless researchers and all the 
ISS international partners have confidence that the facility will be 
supported and sustained as long as it is operationally viable and 
technically useful. To effectively use this great international lab- 
oratory, the ISS requires a guaranteed cargo and crew delivery to 
be available as soon as possible after the space shuttle retirement. 
Yet the committee suggested that the responsibility be removed 
from NASA and offered to commercial contractors. It is feasible for 
the U.S. industry to develop a commercial cargo crew delivery sys- 
tem to the ISS. However, the cargo dimensions are somewhat lim- 
ited. 

The commercial transport of government crews to the ISS has 
major implications of which I have a very different view. I would 
like to differentiate the two subjects: potential commercial crew 
cargo delivery to the ISS and commercial crew delivery to the ISS. 
NASA has incentivized and selected two contractors to provide 
commercial cargo delivery to the ISS, and for commercial cargo de- 
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livery, the first issue is development of a reliable booster to low 
earth orbit. The second issue is to develop an autonomous transfer 
vehicle to transfer the cargo from the booster to the ISS in a safe 
manner that would meet the ISS visiting spacecraft requirements, 
which were recently complied with by the European Space Agency’s 
ATV and the Japanese HTV. 

The development of a transfer vehicle is in itself a significant 
challenge. The European Space Agency recently delivered their 
first ATV payload approximately four years later than their initial 
target delivery date. The Japanese delivered their HTV some two 
years later than their initial target date. Both government entities 
used considerable resources to develop these individual transfer ve- 
hicles. I certainly wish the two U.S. entities success in meeting 
their NASA milestones for cargo delivery since the ISS is depend- 
ent upon continued supply of cargo delivery by the partners. 

With respect to commercial government crew launch delivery to 
the ISS, I would like to recall my own experience. I flew on two 
Gemini missions with a specially modified Titan II ICBM booster 
and two Apollo missions, one on the small Saturn IB and one on 
a giant Saturn V, and over the period of 13 years I experienced and 
participated in development of high reliability, human-rated boost- 
ers, human-rated spacecraft and launch abort systems. I was the 
backup pilot for the first manned Gemini flight and spent many 
months in the factory and countless hours in the spacecraft as it 
was being built and tested. I was then pilot of Gemini VI, the 
world’s first rendezvous mission, and on that the Titan II stage ig- 
nited and then shut down at TO. Wally Schira and I had the liftoff 
signals in the spacecraft and a fire broke out down below the base 
of the booster. The special emergency detection system that had 
been installed on that Titan II helped us resolve a couple of critical 
failures and our own decisions prevented a fatality. Had that not 
been modified and the decisions right, I would not be here today. 
Madam Chairman, and you would have been reading about me in 
the obituary column. 

I was also backup commander for the second Block I Apollo flight 
and had my crew performing a similar test in the sister spacecraft 
at the same time the Apollo I accident occurred and the Apollo I 
crew died in the fire at the Cape. I was a backup commander on 
the first Apollo Block II spacecraft, Apollo VII, and again spent 
considerable time in the factory as it was undergoing tests and fab- 
rication. At that time there were numerous NASA engineers, in- 
spectors, support technicians to facilitate this effort. 

I was then commander of Apollo X, the first flight of the lunar 
module to the Moon and again I spent an inordinate amount of 
time in performing the tests to check out the command and the 
lunar module. 

My fourth mission was commander of the Apollo-Soyuz Test Pro- 
gram. Again, I spent considerable time in that spacecraft and also 
a brief time in the Soyuz spacecraft for the first flew we ever flew. 
These flights both as prime and backup crew members were accom- 
panied by thousands of hours of training in different types of space- 
craft simulators and mockups in which numerous emergency situa- 
tions were simulated and resolved. Therefore, safe delivery of a 
government crew to the ISS involves the human rating of a launch 
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vehicle, the spacecraft, the launch abort system, successful integra- 
tion of all three elements. The process of requirements, design and 
construction, all these parts start with the NASA safety and mis- 
sion assurance requirements. There also has to be a process where 
there is not excessive creep in these requirements which could re- 
sult in cost increases and launch schedule delay. 

Unfortunately, the Augustine report gave just a very brief men- 
tion of crew safety for launch, orbit and recovery operations. The 
report had no in-depth discussion of these vital issues of safe 
launch to orbit and return to Earth of government crews. If NASA 
can provide incentive seed money, can industry raise or finance the 
funds? What are the safety requirements for commercial govern- 
ment crew vehicle? That must be commensurate with other govern- 
ment operating crew transport systems. 

The commercial entities that propose to provide safe government 
crew transport will require a guarantee of a certain number of 
flights for a certain period of time and a price in order to minimize 
or to recover the reoccurring investment and have a satisfactory re- 
turn. 

A major issue is, who assumes liability for the safe government 
crew delivery. If it is commercial, would insurance be available and 
at what cost? If safe commercial flight transportation for govern- 
ment crew does evolve, other questions will arise. On page 72 of 
the committee report it states, “It is critical to the success of the 
program that multiple providers be carried through to operational 
service,” and that statement in itself has a huge financial implica- 
tion for both the government and the commercial providers. If 
NASA is buying a government crew ride rather than a spacecraft, 
then how, by whom and to what standards will the government’s 
equipment and operations be certified? What entity other than 
NASA can establish and verify appropriate standards for human 
spaceflight? That question becomes very crucial. 

Madam Chairman, thank you and the members of the Sub- 
committee for the opportunity to express my opinions. I will be glad 
to respond to any questions you or the other distinguished mem- 
bers have. Thank you. 

[The prepared statement of Lt. General Stafford follows:] 

Prepared Statement of Lt. General Thomas P. Stafford 

Chairwoman Giffords, Ranking Member Olson, and Members of the Sub- 
committee, I am honored to be invited to appear before you today to testify on the 
matter of crew safety in human spaceflight. In the wake of the Augustine Com- 
mittee report, it is imperative that the implications of that Committee’s rec- 
ommendations be considered carefully before this Congress directs, or allows, 
changes to be made to the program NASA has pursued and the Congress has ap- 
proved for more than four years. 

Before proceeding to answer your questions, I would like to make a few observa- 
tions concerning the Augustine Committee report. 

The most important observation of that Committee, and the underling concern 
in all deliberations on the future of U.S. Human Spaceflight, is that it has been in- 
adequately funded for many years now. The budget projected for NASA in the next 
decade and beyond is inadequate to accomplish the core objectives with which NASA 
has been charged. The funding is inadequate to build a timely replacement for the 
Space Shuttle, to return our astronauts and other international partner nations 
from the Space Station to the Earth and then to visit the moon, near-Earth aster- 
oids, and to develop the technology and systems required for the first human voy- 
ages to Mars. 
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This plan for NASA has been approved by the Congress. It is a program offering 
the strategic vision for human spaceflight that was demanded by Adm. Gehman and 
the Columbia Accident Investigation Board. It is a program worthy of our nation. 
The Augustine Committee notes that at least three billion dollars per year must be 
added to NASA’s appropriation to accomplish the mission. Even more importantly, 
the Committee notes that there is no other worthwhile program of human 
spaceflight which could be accomplished for the amount of money presently planned 
for NASA. 

The choice is now plain: either we will provide the funding necessary to accom- 
plish worthy objectives in space, or this nation will cede its leadership on the space 
frontier to others. I wish to add my voice to those who say that this leadership, the 
result of five decades of effort purchased at the cost of nearly a trillion of today’s 
dollars and many lives, some of them given by close friends of mine, must not be 
allowed simply to drift away. As a nation, as a people, we must be better than that. 

Today, I want to acknowledge the intense work performed by the Augustine Com- 
mittee to cover these broad based subjects in such a relatively short period of time. 
After extensive examination of the Committee’s report, I strongly agree with the 
majority of their findings and recommendations. I also strongly agree that the 
NASA Administrator, who has been assigned the responsibility for the management 
of NASA, needs to be given authority to manage NASA. This includes restructuring 
resources, the workforce, and facilities to meet mission needs. However, on some of 
the Committee’s findings, I have a different opinion. 

I agree with the Committee’s recommendation that the remaining Space Shuttle 
flights should be launched on a schedule that is compatible with the normal proce- 
dures used for safe check out test and launch operations, which may extend the 
flights into 2011. We presently have a Shuttle at KSC on standby to launch on short 
notice, if required. If funding were available this Shuttle could carry cargo delivery 
that would enhance the viability of the ISS six-person crew capability. 

The Committee wisely recommends the extension of the International Space Sta- 
tion past 2015 to at least the year 2020. However, the ISS will never be fully and 
effectively utilized unless researchers in all of the ISS partner nation have con- 
fidence that it will be supported and sustained as long as it is operationally viable 
and technically useful. 

To have and to use this great international laboratory requires a guaranteed 
space transportation capability to be available as soon as possible after Space Shut- 
tle retirement. The Committee recommends that this responsibility be removed from 
NASA and offered to commercial providers. 

I would like to differentiate the two subjects, Potential Commercial Cargo delivery 
to the ISS and Potential Commercial Government Crew delivery to the ISS. NASA 
has incentivized and selected two contractors to provide commercial cargo delivery 
to the ISS. For commercial cargo delivery, the first issue is the development of a 
reliable booster to low earth orbit. The second issue is to develop an autonomous 
transfer vehicle to transport cargo from the booster to the ISS in a safe manner that 
would meet the stated ISS visiting spacecraft requirements that were complied with 
by the European Union Space Agency ATV and Japan’s HTV. The development of 
this type of a transfer vehicle is a major challenge. The European Space Agency re- 
cently delivered their first ATV payload approximately four years later than their 
initial target delivery date. Japan delivered their HTV some two years later than 
their initial target date. Both government entities used considerable resources to de- 
velop their individual transfer vehicles. I certainly wish the two U.S. entities suc- 
cess in meeting their NASA milestones for cargo delivery since the ISS is dependent 
upon a continued supply of cargo deliveries by the partners. 

With respect to commercial crew launch delivery to the ISS, I would like to recall 
my own experience. I have flown two Gemini missions on a modified TITAN H, 
ICBM, booster and two Apollo missions, one on the Saturn IB and one on the giant 
Saturn V. Over a period of thirteen years, I have experienced and participated in 
the development of high reliability boosters, spacecraft, and launch abort systems. 
I was a back-up pilot for the first manned Gemini spacecraft and spent many 
months in the factory and countless hours of testing in the spacecraft as it was 
being built and tested. I was then pilot of Gemini VI, the world’s first rendezvous 
mission. On that mission, the TITAN II first stage engines ignited and then shut- 
down at T=0. Wally Schira and I had the lift off signals and a fire broke out below 
the base of the booster. The emergency detection system that had been installed on 
the TITAN II helped us to resolve the two critical failures that we experienced in 
that extremely short period of time. 

I was the back-up commander for the second Block I Apollo flight and had my 
crew performing a similar test, in the sister spacecraft, at the same time that the 
Apollo I accident occurred and the crew died in the spacecraft fire on the launch 
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pad. I was then back-up commander of the first Block II Apollo spacecraft, Apollo 
VII, and spent considerable time in the command module which was being built and 
tested. There were also numerous NASA engineers, inspectors and support techni- 
cians at the factory to facilitate this effort. This support effort was similar to the 
Gemini program, where numerous NASA engineers, inspectors and support techni- 
cians participated in the manufacturing and test at the factory. I was then the Com- 
mander of Apollo X, the first flight of the Lunar module to the moon. Again, I spent 
an inordinate amount of time in performing test and check-out in the command 
module and the lunar module. 

My fourth mission, I was commander of Apollo for the Apollo-Soyuz Test Program. 
Again, I spent considerable time for the test and check out of the Apollo spacecraft 
and a brief time in the Soyuz spacecraft. These flights, both as a prime and as a 
backup crew member were accompanied with hundreds of hours of training in dif- 
ferent types of spacecraft simulators and mockups where numerous emergency situ- 
ations were simulated and resolved. 

Therefore, safe delivery of a government crew to the ISS involves the human rat- 
ing of the launch vehicle, the spacecraft, and the launch abort system, and the suc- 
cessful integration of all three elements. The process of requirements, design, and 
construction all begin with the NASA safety and mission assurance requirements. 
There also has to be a process where there is not an excessive creep in requirements 
that would result in cost increases and launch schedule delays of the vehicles. The 
Augustine Committee report gave just brief mention of crew safety for launch, or- 
bital, and recovery operations. Unfortunately, there were no in-depth discussions of 
the vital issue of safe launch to orbit and return to earth of government crews. 

It may be that the complexity of developing a new government crew space trans- 
portation capability, and the difficulty of conducting spaceflight operations safely 
and reliably, it is not fully appreciated by those who are recommending the cancella- 
tion of the present system being developed by NASA, and the early adaptation of 
the presently non-existent commercial government crew delivery alternatives. There 
seems to be some belief that if NASA would “step aside”, private alternatives would 
rapidly emerge to offer inexpensive, safe, reliable, dependable government crew de- 
livery space transportation at an earlier date. 

Human spaceflight is the most technically challenging enterprise of our time. No 
other activity is so rigorously demanding across such a wide range of disciplines, 
while at the same time holding out such harsh consequences for minor performance 
shortfalls. Aerodynamics, aerospace medicine, combustion, cryogenics, guidance, and 
navigation, human factors, manufacturing technology, materials science, structural 
design and analysis — these disciplines and many more are pushed to their current 
limits to make it possible and just barely possible at that, to fly in space. Space is 
very, very hard. 

We’ve learned a lot about human spaceflight in the last five decades, but not yet 
nearly enough to make it “routine” in any meaningful sense of the word. As Adm. 
Gehman and the CAIB outlined, these flights in the past have been developmental 
flights and the relatively small number in the future will be the same. Thus far, 
it has been a government enterprise with only three nations yet to have accom- 
plished it. Development of new systems is very costly, operational risks are ex- 
tremely high, and profitable activities are elusive. It may not always be this way, 
but it is that way at present. 

Apart from questions of technical and operational complexity and risk, there are 
business issues to be considered if the U.S. is to rely upon commercial providers for 
government crew access to space. It is not that industry is incapable of building 
space systems. Far from it. It is American industry which actually constructs our 
nation’s space systems today, and carries out most of the day-to-day tasks to imple- 
ment flight operations, subject to the government supervision and control which is 
required in managing the expenditure of public funds. 

So the question is not whether industry can eventually develop government crew 
delivery systems and procedures to fly in low Earth orbit. It can. The relevant ques- 
tions in connection with doing so commercially are much broader than that of the 
relatively simple matter of whether it is possible. Let us consider a few of those 
questions. 

Absent significant government backing, will industry provide the sustained invest- 
ment necessary to carry out the multi-year development of new commercial govern- 
ment crew delivery systems to LEO? Will industry undertake to develop such prod- 
ucts with only one presently known customer, the U.S. Government? What happens 
if, midway through the effort, stockholders or boards of directors conclude that such 
activities are ultimately not in the best interests of the corporation? 

What happens if, during development or flight operations, an accident occurs with 
collateral damages exceeding the net worth of the company which is the responsible 
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party? A key lesson from the development of human spaceflight is that safety is ex- 
pensive, and the failure to attain it is even more expensive. Apollo 1, Challenger, 
and Columbia have shown that spaceflight accidents generate billions of dollars in 
direct and collateral liabilities. Who will bear this risk in “commercial” space oper- 
ations? If the company, how much insurance will be required, where will it be ob- 
tained, and at what cost? If government indemnification is expected, upon what 
legal basis will it be granted, and if the government is bearing the risk, in what 
sense will the operation then be “commercial”? 

When commercial government crew delivery space transportation does come 
about, other questions will arise. Will there be competition in this new sector, or 
will there be a monopoly supplier? If NASA is to contract with the first, or only, 
commercial government crew space transportation supplier, and if there is no price 
ceiling established by a government alternative, how do we ensure a fair price for 
the taxpayer in a market environment in which the government is the only cus- 
tomer for the products of a single provider? And how is a space operation “commer- 
cial” if the government is both regulatory agency and sole customer? 

Leaving aside technical, operation, and business concerns, there is the matter of 
the schedule by which these new commercial systems are expected to come into 
being. The Augustine Committee has been particularly pointed in its clams that, 
with suitable government backing, such systems can be made before the comparable 
Constellation systems. Ares 1 and Orion, could be ready. Page 71 of their report of- 
fers such a claim. 

Are such claims optimistic? Any launch system and crew vehicle that can trans- 
port a half-dozen people to and from the ISS, and loiter on-orbit for a six-month 
crew rotation period while serving as an emergency crew return vehicle, is nec- 
essarily on the same order of complexity as that of the old Saturn 1 and the Apollo 
systems. The Saturn 1 conducted its first test flight, with a dummy upper stage, 
in October 1961, and carried a crew for the first time in October 1968. The Apollo 
VII spacecraft which carried that crew, of which I served as back-up Commander, 
began its own development in 1962. Thus, the Earth-orbital segment of the Apollo 
system architecture required a half-dozen years and more to complete. These devel- 
opments were carried out by highly experienced teams with virtually unlimited de- 
velopment funds in the cause of a great national priority. 

If, in the fashion of airline travel, NASA is buying a ride rather than a spacecraft, 
then how, by whom, and to what standards will the company’s equipment and oper- 
ation be certified? How is NASA to determine that the system is truly ready to fly? 
Does the government merely accept the claims of a self-interested provider, on the 
basis of possibly very limited flight experience by company pilots? We certainly do 
not do that for military aircraft, and even less so is this the case for civilian trans- 
port aircraft. Extensive development and hundreds or even thousands of hours of 
flight testing followed by operational test and evaluation by the government is re- 
quired before a new military aircraft is released into operational service; I’ve done 
that kind of testing. Similarly, new civilian aircraft are subject to extensive testing 
involving certification of systems and hundreds of flights to exact certification stand- 
ards before they are allowed to be put in passenger service. Will we accept less for 
new, “commercial” space systems which carry government astronauts, or those of 
our international partners? In my opinion, the Congress should certainly not accept 
less. 

Yet, today, we do not even know what standards should exist for the certification 
of commercial spacecraft to carry government crew members into orbit. What entity 
other than NASA can establish and verify appropriate standards for human 
spaceflight? I will tell you that from my perspective and from the history that I have 
lived, these standards, like airworthiness standards, are written in other people’s 
blood. Some of that blood was shed by friends of mine. We don’t know enough, yet, 
about human spaceflight to relax the hard-learned standards by which we do it. And 
we certainly do not yet know enough to make the assumption that new and untried 
teams can accomplish it on a schedule that is better than was achieved during Apol- 
lo. 

This takes me to another point. Some of you may recall that, a few years back, 
I chaired a Task Force on International Space Station Operational Readiness. This 
task force was charged with making an independent assessment of our readiness to 
put crew on the ISS, and to sustain it with the transportation systems, Russian and 
American, which were necessary for cargo delivery and crew rotation. We did not 
take this matter lightly. The ISS was new, and much smaller. We did not then have 
the years of experience we have since accumulated in building the ISS and fl 3 dng 
on it. Our then-recent long-duration spaceflight experience had mostly been accumu- 
lated during the Shuttle-Mir program, and Russian experience in resupplying the 
Mir and the earlier Salyut space stations was not unblemished. Numerous docking 
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failures had occurred over the lifetimes of these programs, resulting not only in 
cargo which went undelivered but also, in one case, the collision of an unmanned 
Progress resupply vehicle with the Mir. An in another instance there had been a 
fire on Mir itself and the first crew to visit their first very small space station Sal- 
yut died after performing the orbit maneuver to reenter the atmosphere. 

These indicants and accidents gave us pause. Not because we doubted the capa- 
bility of the team; the Shuttle had been flying for over fifteen years by that time, 
and the Russians had accumulated decades of experience in long-duration 
spaceflight. I’ve flown with them; I know how capable they are. No, our concerns 
were heightened by our awareness of just how careful one has to be in this most 
demanding of enterprises. We cannot afford to relax that vigilance today as we go 
forward into a new era of ISS utilization, and as we prepare once again to voyage 
outward from Earth, first to the moon or the asteroids and then beyond. There is 
a place in these plans for the contributions of commercial government crew space 
transport entrepreneurs, but not yet demonstrated, and not to the exclusion of 
NASA’s own systems. 

I have asked many questions in this testimony, questions which I believe must 
be answered if commercial government crew human spaceflight is to become viable. 
I believe that these questions and others yet to come can and will be answered at 
some date. However, America’s continued leadership in space should not depend 
upon the nature and timing of those answers. When commercial entities can provide 
dependable transportation reliable, U.S. government crews as well as partner nation 
crews, the government should buy it. But until that time, there should be an as- 
sured government capability to accomplish the task. 

Thank you. 

Chairwoman Giffords. Thank you, General. 

I want to thank all of our witnesses today, and we are really 
blessed to have such a star-studded group of individuals with life- 
times worth of knowledge and expertise. 

We are going to begin our round of questions now. I am going 
to start with 5 minutes, and because we have so many members, 
I will try to really make sure that we all speak for five minutes 
including cutting myself off. 

Safety of Launch Systems 

Let me begin with something that Dr. Fragola had put in his tes- 
timony and touched on it with his slides. You had stated that it 
was your belief that the Ares I launch vehicle because of its inher- 
ent focus on being as safe as achievable from the very beginning 
has the best chance to be outstandingly safer in terms of it being 
a crew launcher. You talked about that as a good way to begin 
from just the very start. Given the fact that we are under enor- 
mous budget constraints here in the Congress and that funds avail- 
able for NASA’s human spaceflight and exploration program are al- 
ways going to be more constrained than we would like, we need to 
think about how we prioritize, and I would like to hear from I 
think General Stafford and Mr. Marshall on how important a factor 
should the inherent safety of the Ares I vehicle be for Congress to 
consider as we make a decision on which launch system or systems 
to pursue in meeting NASA’s International Space Station and ex- 
ploration needs. I would also like to hear whether or not this 
should be the inherent safety of the Ares I, should this be a signifi- 
cant discriminator when choosing among alternatives and also who 
should carry the burden of proof? General, let me start with you. 

Lt. Gen. Stafford. Madam Chairwoman, again it starts with the 
requirements stated there by the NASA Safety and Mission Assur- 
ance, and I noticed that the astronaut group had stated their own 
requirements, that the reliability of the crew from launch into orbit 
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is three nines. In other words, you have had a failure no more than 
one out of 10,000. I did my own review and my best memory back 
from Apollo, and we were striving for four nines at that time. 
Madam Chairman, 40 years ago, and just to be sure that I had this 
right I checked with Dr. Chris Kraft, who was there with the space 
task group and director of mission operations and then was later 
center director, and he said that they were striving for four nines, 
and in fact. Dr. Kraft said he would like to give a few of his 
thoughts on his how to distinguish reliability of boosters. 

“Since the first time a pencil was put to paper, the engineers and 
technicians are all responsible that the vehicle be used to carry as- 
tronauts and others into space. They know that the life of the indi- 
vidual depends on it. This is true of the first-level engineer, the 
lead designer, the chief engineer, the program manager and com- 
pany executives. This is also true of the machinists, the contract 
buyer, the piece part selector and the safety, reliability and quality 
control experts and the test engineers and eventually by the person 
who has to stand up on launch day and say ‘go’ when that launch 
director asks. 

“In my opinion, that is the case for the Ares I and Orion. It is 
not the case for the COTS-crewed government vehicles. To think 
that it is the large and dedicated oversight, you know, group could 
provide the same amount of credibility and reliability and safety 
and quality for a machine is to say that the first paragraph was 
misunderstood and has probably not been experienced.” 

So it starts right from the very start. And I know from my own 
experience that the Titan II had several dead zones in it. That pro- 
gram in Titan Gemini was a high-risk demonstration program only. 

Chairwoman Giffords. Thank you. General. 

Mr. Marshall? 

Mr. Marshall. Well, first of all, as you have heard today from 
this panel, I think everybody agrees that safety has got to be an 
integral process of selection and enforcement of any vehicle that is 
used in the future for human flight to provide astronaut travel to 
any place in low earth orbit or beyond. So I think that that is an 
absolute given that it has to be fundamentally thought through 
from the very beginning. That said, the ASAP has had the oppor- 
tunity to look and observe the evolution of the Ares process. We 
have challenged Jeff and his team on numerous occasions and we 
have been very, very impressed by the product and the processes 
that they have employed. The commercial side is just now begin- 
ning, and as I noted in my opening statement, we, the ASAP, be- 
lieve actually that NASA is behind because they haven’t articulated 
what the requirements are from a human ratings requirement. We 
find good receptivity from the commercial providers thus far but 
the truth is, if they are building vehicles today and we would rath- 
er have had those rating requirements articulated so that they 
could be integrated into the design processes at that moment rath- 
er than let them transpire and move forward for integration at 
some other time. So we are very concerned about where the COTS- 
D program or the like or similar name is in this process case, so 
the basic bottom line is, safety has to be a primary consideration 
in any selection of any vehicle. 

Chairwoman Giffords. Thank you, Mr. Marshall. 
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Next we will hear from Mr. Olson. 

NASA — Commercial Industry: Sharing of Safety 
Standards 

Mr. Olson. Thank you very much, Madam Chairwoman, and I 
would like to follow up on Mr. Marshall’s comments but with you, 
Mr. O’Connor. I mean, that is one of the criticisms we have heard 
about the COTS-D program, NASA’s commercial space, is that 
NASA is behind in getting the information to the industry as to 
what they need to do to become human rated. And so could you 
briefly explain how NASA uses its human rating requirements to 
tailor the design of a particular crewed system such as the Ares 
and the Orion, and again, following up on the line of questioning 
of Mr. Marshall’s comments, if the human rating requirements are 
the top-level requirements, how would a potential commercial pro- 
vider gain the insight to design a system that meets NASA’s re- 
quirements? And one more question, how did NASA get com- 
fortable enough to finally certify the Soyuz for human spaceflight? 

Mr. O’Connor. Yes, sir, glad to answer those. The first part of 
this is the commercial crew transport. Currently, there is no formal 
start of that program. We have been talking about it. We have 
asked for people to — commercial companies to give us information 
on how they think that might go. We have made our regulations, 
our policies, our requirements known. All that have asked for 
them, we have made them available. As I mentioned, even those 
things that are not yet transformed into requirements and stand- 
ards, the results of the survivability study that we did in 2008, 
that has not yet been flowed into a set of standards but we tried 
to make that available as well. The human rating requirements 
document at the top level is 31 technical requirements, or what I 
call “shall” statements. It is very limited. It is very top level. It is 
the kind of thing that says that shall have an abort escape system, 
you shall have failure tolerance in your design. But in the begin- 
ning of that document it says that there are three pieces to this. 
The first piece is that you are expected with your design to do all 
the things in a NASA development that are required throughout 
the whole set of standards and requirements, not just those 31 but 
all the mandatory standards and requirements are given before you 
get into this human rating requirements document. 

This is where tailoring comes in. We spent six to eight months 
with the Constellation team and my team going over the flow-down 
of all the safety and mission assurance requirements. These re- 
quirements come in the form of documents that are called manda- 
tory standards or mandatory requirements. But in order to know 
which of the “shall” statements that are embedded in those things 
really apply, you have to go through a pretty thorough flow-down 
activity and we did that with Constellation. It took about 6 to 8 
months to go through that tailoring process to figure out for this 
particular concept, for this particular mission, for this particular 
design which of our “shall” statements would apply. We also in- 
vited the team to come in with alternatives. There is a NASA 
standard but there is also alternatives. Industry has some stand- 
ards, for example, on how to do soldering and so on. We start with 
the NASA standard but we invite our contractors and our projects 
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to come in with alternatives if they think they can do it just as 
well. This is part of that “Yes If’ thing I was telling you about ear- 
lier. 

Now, as far as something that we don’t design because our NASA 
human rating requirements document is for a NASA development. 
Now, in the past we said we would like to fly with the Russians. 
We would like to fly one of our astronauts. Norm Thagard back in 
1995 flew on the Soyuz. The Soyuz was not built to any given 
NASA standards of the day. It was built to Russian standards back 
in the 1960s. The process for building and assembling and launch- 
ing the Soyuz was not to NASA standards. It was to longstanding 
Russian procedures. To get to the comfort level we needed to fly 
our person on their mission, we spent about three years with some 
of our best engineers working with the Russians to understand the 
equivalence of their system. We know they don’t do things exactly 
the way we do but can we get confident about it, and we took some 
time and a lot of good people to develop that confidence, and in the 
end we got to the point where we believed that even though they 
may not do things exactly the way we do, we are confident to the 
same level that we would if we were flying them on one of our sys- 
tems. This business of acceptability of risk is part meeting require- 
ments. It is also part building the confidence where the require- 
ments don’t exist or where they are someone else’s requirements. 
We need to do a risk-informed confidence-type activity to get to 
where we feel comfortable doing it. 

Mr. Olson. Well, thank you for that very thorough answer to my 
question. I see my time is over. I yield back. 

Mr. Marshall. Sir, may I make an addition if I may? 

Chairwoman Giffords. Yes, Mr. Marshall, just briefly, though. 

Mr. Marshall. I just wanted to report that we have followed up 
with NASA as to where they are. We received a detailed briefing 
in November and are satisfied that the approach that they are 
moving forward is now appropriate and timely. 

Mr. Olson. Thank you, Mr. Marshall. 

Chairwoman Giffords. Thank you, Mr. Olson. 

Dr. Griffith, please. 

Potential Impact of Constellation Program on 
Commercial Sector 

Mr. Griffith. Thank you. Madam Chair, and thank the panel for 
being here. We have been in numerous, numerous hearings prior 
to the Augustine report and after the Augustine report. Each time 
the Ares I comes to the top as a respected and well-thought-out 
plan some four, five years in the making. The successful test of 
Ares I-X was an achievement that we truly, truly appreciated and 
with the 700 sensors that were mentioned and the data that is 
going to be collected, it seems to me that the commercial aspect of 
this was an introduction into the Augustine report that was fas- 
cinating and it is greatly discussed but it is not hard science as we 
have now today with documentable evidence of safety. It is prob- 
ably three, maybe four or five years out and it seems that we could 
achieve our commercial aspirations in space by developing the Ares 
I to the point where it is reliable, consistent. Our solid fuel engine 
is reliable. Our liquid fuel motor is reliable. Our Orion capsule is 
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going to be reliable. We have every reason to believe that it is and 
it seems like our steppingstone into the commercial venture is suc- 
cessful development of Ares where it can be insured, where we can 
be confident that our human spaceflight, our astronauts can be in- 
sured and it can be successful. 

My question is, why wouldn’t we take the approach of asking our 
government to fund the Constellation project with the idea in 36 
months or 48 months we could transfer much of that information 
into the commercial sector with a great deal of confidence and not 
delay the challenge that we are facing with China, India and 
Japan? Mr. Alexander, would you address that, please? 

Mr. Alexander. First of all, I think it is important to remember 
that Ares, Orion, particular Orion, is designed for exploration be- 
yond LEO. It is a spacecraft whose prime purpose is to take — origi- 
nally designed to take people to the Moon and back and the space 
station if necessary if there were not alternatives. As such, it is a 
more complex spacecraft and more expensive spacecraft than I 
think what you would want to do commercially. As for the Ares I 
rocket in terms of commercial use, I think you also have an infra- 
structure, a per-flight cost that would be prohibitive from a com- 
mercial perspective. That being said, the Commercial Spaceflight 
Federation, you know, takes no position over whether the Ares I 
program should continue as is or should be changed or Orion for 
that matter. I personally believe that, you know, this country needs 
an exploration program and it needs a crew exploration vehicle like 
Orion to go beyond low earth orbit. That is very important for the 
Nation’s human spaceflight program. But at the same time, we 
don’t need to be serving all missions with the same vehicle because 
then you are not optimized for any one mission, and I believe and 
I think the Augustine Committee found that the capability or the 
technology, the knowledge is resident in U.S. industry to do crew 
transfer and cargo transfer to low earth orbit and that if NASA 
wants to get on with the business of exploring beyond low earth 
orbit, it needs to transition operational tasks like that to commer- 
cial sector so that it is not continually taking on more obligations 
than it can afford to take on. 

Mr. Griffith. Thank you. 

Human Rating for Commercial Sector 

Mr. Hanley, the timeframe for human rating on Atlas or Delta 
for the astronauts would be what? What would we look at if we 
said today that we are going to develop commercial sector with tax- 
payer-funded money and a commercially or human-rated launch ve- 
hicle? 

Mr. Hanley. Well, the work that we have done over this last 
year, we had a study that was performed by the Aerospace Cor- 
poration for NASA. They projected, and I am going on memory 
now — we can get an answer for the record if I misstate this but I 
believe it is on the order of six years from start to develop a system 
that would have been derived off the Delta IV heavy launch vehi- 
cle. That booster as Aerospace studied it would have used the exist- 
ing core stage and a new upper stage. Not included in that study, 
of course, were the implications to the Orion if Orion had to change 
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at all, and that would be something that would have to be further 
studied. 

Mr. Griffith. Thank you. 

Thank you, Madam Chairman. 

Mr. Alexander. Could I follow up on that, please? 

Chairwoman Giffords. Sure, Mr. Alexander. 

Mr. Alexander. That study as described by Mr. Hanley was 
talking about a Delta IV heavy vehicle that is for the Orion space- 
craft to low earth orbit, a 25-metric-ton spacecraft. It did not ad- 
dress or at least in the comments did not address the Atlas V 
version vehicle which has flown 19 times successfully, which would 
be used to put commercial crew capsules that are on the order of 
8 to 12 metric tons up into low earth orbit. So it is not an apples- 
to-apples comparison to talk about a six- or seven-year human rat- 
ing process for one vehicle when in the commercial world we are 
talking about a different vehicle that has already, you know, 
achieved a certain demonstrated reliability, would go through a 
human rating process but is certainly not at the six- to seven-year 
timeframe. 

Mr. Griffith. But what would be your estimate other than the 
six to seven years. Would you say three? 

Mr. Alexander. I would say that. I think the capsule is what is 
going to drive the timeline, not the human rating and the launch 
vehicle. 

Mr. Griffith. Lieutenant General? 

Lt. Gen. Stafford. The experience we had with the Gemini 
Titan, and that was an all-out push, was 39 months. It was over 
three years. And we had some dead zones in that, and I don’t see 
how this could be any sooner. It will probably be longer. One thing 
I might add about this gap, and I would rather not transfer money 
to Russia just like anybody on this Committee would, but I think 
one thing to look at that has occurred is that the 0MB to me in 
de facto has set space policy when they came in and cut money 
back and said you will finish — first originally came in just a person 
over there a second-level tier said the Administrator will finish it, 
15 flights 2008, they said, but the President said we are going to 
complete the space station, phase out the shuttle and said maybe 
so but this is what it is. So to me, there needs to be an institution, 
someone like the National Space Council used to have that would 
oversee that so that second-level tier and groups like that would 
not cut back. If the proper money, it is my understanding, sir, had 
been applied, we would have had the Ares Orion flying in 2012 or 
2013 so there would not have been too much of a gap. And I don’t 
know that the President ever really got the word back because he 
had other major issues on his desk at that time like Iraq and Af- 
ghanistan. 

Mr. Griffith. Thank you. Madam Chair. 

Chairwoman Giffords. Thank you. General Stafford. Thank you. 
Dr. Griffith. 

Next we will hear from Mr. Hall, please. 
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Program Management and Scheduling Issues Be- 
tween Congress, Administration, and NASA Over 
Time 

Mr. Hall. Thank you. Madam Chairman. 

General Stafford, you worked in the space program for many, 
many, many years and you spanned a lot of days from Apollo to 
the current shuttle program, and I think you are about as knowl- 
edgeable as anyone I know, and you know we are looking for a way 
to save the program that I guess the last four or five or six Con- 
gresses have agreed on to pursue, and that involves having to ad- 
dress that four-year gap in there, and if I may be wrong, I probably 
am, but it seems like to me that we need about $2 billion a year 
additional for about four years to make that happen. And what 
that would do would preserve our leadership in space, would pre- 
serve our space station, would preserve our friendship with some 
partners that have been good partners in space. What was your ex- 
perience during the Apollo program in working with Congress and 
the Administration on program management and scheduling 
issues, and could you highlight the major distinctions between then 
and now? It was a lot easier then than it is now, and I think we 
just have to keep insisting that the President either in the next ad- 
dress to the Nation comes on in and recommends what we have all 
asked for and what I think everybody on this Committee here 
wants, to save our space station, save our position in space and not 
have to rely on Russia for anything. You might just in a minute 
or so if you can just kind of compare those times with today. 

Lt. Gen. Stafford. Thank you, Mr. Hall. The President’s policy 
was carried out completely with the help and approval of the Con- 
gress. The National Space Council that was chaired by the Vice 
President helped oversee that and the 0MB followed in line, and 
as I mentioned just previously, it appears that in certain cases the 
0MB in de facto is setting space policy, and this is one of the real 
issues. Also, we have today Continuing Resolutions that we didn’t 
have in those days. But if the President sets a policy, it should be 
carried out and the funding you said would certainly do it, so we 
could have had the Ares Orion flying in 2012 or 2013 so there 
wouldn’t have been much of a gap in this. Thank you, sir. 

Mr. Hall. Any others want to make any comment on that? You 
are all experienced and you have been around all a while. You 
know, not too many years ago we almost lost the space program 
by one vote in Congress, and that alerted everybody from school- 
children and everybody else that is interested in the space pro- 
gram. It even caused a fine old man like Dr. DeBakey to come and 
walk out all four of the floors here in the Rayburn Building to talk 
to everybody, and a lot of them couldn’t find time to talk to him 
because they didn’t want to tell him no. But that following year I 
think we passed the program by something over 100 votes, 120 or 
something, but then we all got together on it. I am just wondering 
what kind of pressure we can put on the President of the United 
States to come out with a recommendation. Of course, back in 
those days, that is before Katrina and before the vicissitudes of na- 
ture had set us back in several of our states and 9/11 and 8, nine 
years of war. We are in a little different situation. But you know. 
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if you can throw away $350 billion on AIG and not even know 
where it is going or not ever receive an accounting for it, they can 
find $2 billion a year for the next four years for us to save a pro- 
gram like the space program. It is a lot harder to do now but you 
six men are leaders and more knowledgeable than anyone I know — 
this is the best panel I have seen up here in a long, long time — 
to put your shoulder to the wheel and every chance you get talk 
to the President, talk to the czar, talk to whoever you have to talk 
to to get into it. But we need to save this program. We need to go 
forward with this program and we don’t need to fall back behind 
or have to battle with China or any other nation. We just have to 
assert ourselves some way and find that money. If we are going to 
have all these bailouts, this is an awfully good place for one right 
now. Save the program. I have even thought about trying to alert 
all the schoolchildren of America for write-ins to get them to write 
in what they think about it because they are the real loser or bene- 
ficiary of what you do and what this Congress is going to do this 
year and next year with regard to the space program. 

But you see a lot of difference in then and now, don’t you, Tom? 

Lt. Gen. Stafford. Mr. Hall, I certainly do. It is a different era. 
In the cooperation between the President, the Congress, the 0MB, 
it is completely different, sir. I wish it could be like that. In fact, 
it could be possibly a recommendation from me to this Committee 
to say that the 0MB should follow the policy of the President. 

Mr. Hall. And then we want to talk to the President. I yield 
back. I think I have used my time. Thank you. Madam Chairman. 

Chairwoman Giffords. Thank you, Mr. Hall. 

One of the reasons why we have held so many hearings, two 
hearings ago we had a fascinating panel of experts to talk about 
tech transfer from NASA because in so many ways the accomplish- 
ments of NASA go beyond just exploration or go beyond what we 
can physically see up in space right now, but from the airline in- 
dustry to the medical industry, computers, it has been extraor- 
dinary the gifts that NASA has given to our country and to the 
world and so part of our job on the Subcommittee is to make sure 
that the American people, the President, other Members of Con- 
gress understand that as well. 

Next we are going to hear from Ms. Edwards. 

Implementation and Application of Safety Standards 

Ms. Edwards. Thank you. Madam Chairwoman, and thank you 
to the panel. Every time we have these hearings, I learn something 
new. In my mid-20s I recall sitting in front of a monitor at Goddard 
Space Elight Center, the elation of a launch in January 1986, the 
confusion thinking that there was something that we had done 
wrong in our communications on that day, and then the absolute 
silence of silence, unlike any I have ever heard over our colleagues 
as we realized the disaster that had happened with the Challenger. 
And I think at that time I think all of us, no matter what we did 
believe, that we paid great attention to safety and obviously the in- 
vestigations that followed demonstrated that there were huge gaps 
in safety, pockets where there was a lot of attention to safety and 
other pockets where there wasn’t, and we even to this day and 
after the Columbia disaster continue to point to some of those same 
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gaps, and I think, you know, safety has to he north, south, east and 
west in NASA whether the services and work is being performed 
by a contractor or internally at NASA and so I appreciate the testi- 
mony today. 

In looking at the Augustine report, there is really actually very 
scant mention of safety in the report I think as General Stafford 
pointed out and so one of the questions that I have really is, and 
especially with the principles that I think Dr. Fragola, you outline, 
how you would take those principles today and actually even apply 
them to Challenger and to Columbia to see whether, you know, 
these design systems, for example, that had been, you know, 
launched — I don’t know — 25 times, I think when the Challenger 
disaster happened and we would have described those as, you 
know, pretty reliable, but whether those principles applied today 
would allow Challenger and Columbia to meet the mark as you 
have indicated that perhaps in the design and the concept of Ares 
you think that that would meet the mark. 

Mr. Fragola. The principal problem with the space shuttle is a 
lack of abort system, the lack of being able to address the recovery 
of the crew given an incident. The shuttle as a launch vehicle is 
among the best, if not the best in the world as a reliable vehicle 
but the shuttle points out very dramatically the difference between 
reliability and safety. I would also like to point out, having been 
involved in the original shuttle competition, the reason — one of the 
reasons we sought the shuttle was, we were concerned at the time 
about recovery of the Apollo capsule. We had had one failure where 
we lost one parachute and we were concerned about that system 
and we were therefore interested in designing a system that would 
address the failings of the past, and so we felt that a landed sys- 
tem, a system with wings, would improve on the recovery, and it 
certainly has improved on the recovery but it has increased the 
vulnerability in ascent and increased the vulnerability in other 
areas. So one of the things that I think we should learn from this 
is that we can’t anticipate all the unknown unknowns in a system, 
and that is one of the reasons why it is essential to have a robust 
and well-tested system that is able to survive and abort safely. We 
didn’t do that on the shuttle. 

Ms. Edwards. So Mr. Marshall, I wonder if you would describe 
for me how it is that we could apply a set of safety standards and 
principles both within NASA and also in a commercial environment 
given our experiences? 

Mr. Marshall. Well, you heard earlier that the FAA ought to be 
the licensing authority for commercial venue. We certainly agree 
with that and we think that there is a need to really aggressively 
develop that process. I am not an expert on that and haven’t par- 
ticipated but my understanding is that the process is just begin- 
ning. Conversely, NASA establishes the crew safety requirements, 
and this is what I was talking to from a commercial venue. We, the 
ASAP, believe that NASA does a great job for its own government- 
controlled programs but that this process really needs to be acceler- 
ated from a commercial perspective if there is going to be move- 
ment and direction in that particular arena. So we think that it is 
a combination of both the licensing authority and the user of that. 
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which is the NASA authorities, to aggressively develop the human 
rating standards that are necessary to provide for the crew safety. 

Ms. Edwards. Thank you. 

Madam Chairwoman, I know my time is expired. I obviously 
have tons more questions. 

Chairwoman Giffords. Thank you, Ms. Edwards. 

Next we will hear from Mr. Rohrabacher. 

Mr. Rohrabacher. Thank you very much. Madam Chairman, 
and again, thank you for your leadership in this Subcommittee. 

Constellation Program: Human and Certification 
Options Concerns 

First of all, let me just state, I am not opposed to the Constella- 
tion concept. I think that from what I have seen, the Orion and 
Ares system has a role to play. I am a bit worried that what we 
have here, however, is a mindset that I have seen before and a 
mindset that has failed before, and that is, trying to have one sys- 
tem that will serve all needs and thus actually bring down the 
chance of success of that mission or the ability of that mission to 
actually do a very great job in a specific area. I remember the 
Edsel car was supposed to be something for everybody and it 
turned out to be nobody in particular really wanted it because it 
was designed for everybody. I remember the F-111, which was an 
aircraft that was designed supposedly — I remember that during the 
early 1960s and it was supposed to be something that could fulfill 
every mission but then once they built it, none of the military peo- 
ple really wanted it because it really didn’t fulfill any of the mis- 
sions as well as they had hoped or what they wanted. I would hope 
that with Ares Orion, we are not making that same mistake trying 
to say that we have to have the same rocket and transportation 
system for low earth orbit that we have to have for other missions, 
later on the Moon, and I support the moon mission. That is why 
I think maybe the Ares Orion system is important in the long run 
but why in the short run do we have to have it fulfilling the same 
needs that we could perhaps serve — might be better served by 
making the Delta system, which is a very good system, been very 
reliable, or the Atlas V system, and just making them with the 
ability to carry people then and they can, I guess, man certified I 
guess is the words we are looking for. So why is it that we have 
to have — Mr. O’Connor, why is it that we have to have Ares doing 
everything rather than going with trying to do manned certification 
for Delta and Atlas? 

Mr. O’Connor. Well, sir, this is a decision that was made some 
time back when we were looking at the vision and what we wanted 
to do with human spaceflight, and in the context of the mission, 
which was to have something that would take our astronauts to the 
moon as a steppingstone to further out, the concept included two 
different launch vehicles, one heavy and one light, and the light 
one was carrying crew. And by definition, the light system that car- 
ried the crew had to be able to take the crew to low earth orbit. 
Now, the Orion was designed 

Mr. Rohrabacher. Having to do that doesn’t necessarily mean 
it is the most cost-effective and the most efficient way of doing it. 
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Mr. O’Connor. Right, and I agree. It had to do that as part of 
the lunar mission, and if you simply said let us not worry about 
the lunar mission, let us do something just to low earth orbit, then 
you would start from scratch and say let us do something that is 
just for low earth orbit, and you may not have the Ares Orion sys- 
tem. 

Mr. Rohrabacher. We spent a lot of money on the Delta and 
Atlas systems over the years and they have proven themselves in 
terms of actually launch systems. I don’t know, we haven’t put peo- 
ple on them but they have proven very reliable in that. Again, I 
don’t — and by the way, I support the moon mission. I think the 
moon mission is a good mission and that is why I support the Ares 
Orion system but suggesting that we then have to because that is 
going to be used for a later mission, we have to use that rather 
than Delta or Atlas, I don’t think it makes sense. There is some- 
thing that doesn’t — I am going to have to study this a little more. 
It just doesn’t seem to come together for me that that is a require- 
ment. 

Mr. O’Connor. Yes, sir. You know, when we looked at this — and 
I am going to defer to the program manager on this because he has 
looked at it harder than I have but just from my view as the safety 
guy, it seemed to me that either one of those two options was an 
F-111 equivalent. The Atlas and Delta are not designed to carry 
people in space. They don’t have the structure for it. They were de- 
signed for cargo, and they are very reliable but they would have 
to be significantly modified in order to do 

Mr. Rohrabacher. Well, you know, reliability of cargo, what we 
are talking about is human cargo, and I don’t see that as being in 
a totally different category. You just want to make things a little 
bit adjusted for human beings. 

Well, my time is up. Thank you very much. Madam Chairman, 
and maybe we can have a second round if we have time. 

Chairwoman Giffords. Indeed. 

Mr. Hanley, would you like to comment? 

Mr. Hanley. Just to address your concern with respect to the ex- 
ploration mission and Ares I, the underpinnings of the Constella- 
tion’s exploration architecture to go to the moon was integral to the 
decision to choose Ares I or something quite like it when those de- 
cisions were made. We began from the process of the design of the 
Constellation system with the moon in mind. The key driving re- 
quirements of Constellation, the preponderance are for the lunar 
mission. So we selected it because where we want to be taking our 
risk is on the lunar surface, not in the first 100 miles. And we le- 
veraged off of the decision that we made on heavy lift, and because 
Ares I is derived from the infrastructure we need for the big rocket, 
the Ares V, you get it at sort of a marginal additional cost. The de- 
sign of the first stage solid and the design of the upper stage en- 
gine on Ares I are the same assets that are used for the Ares V, 
so the production capacity is common for those. 

Chairwoman Giffords. Thank you, Mr. Hanley, Mr. Rohr- 
abacher. 

Ms. Kosmas, please. 

Ms. Kosmas. Thank you. Madam Chairman. Thank you, gentle- 
men, for being here today. This is obviously an issue of great im- 
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portance to us here on the panel and also I think to the American 
public as we move forward and make every effort to maintain our 
leadership in space exploration for all the reasons that are obvious 
to us and that we attempt on a regular basis to make obvious to 
others, so we thank you for being here. 

ESAS Recommendations for Human Space Flight 

No question about the fact that safety is a very important con- 
cern. I want to chat with you a little bit about an article that was 
in today’s Orlando Sentinel. I am from central Florida where the 
Kennedy Space Center is and so it is a big issue for us in our dis- 
trict with regard to what the next phase of space exploration will 
be, and also a great concern of course for the gap, but nevertheless, 
safety of course is very important. The story in today’s Orlando 
Sentinel discusses the 2005 architecture study, ESAS, rec- 
ommendation that after two test flights, the first five flights of the 
new rocket and capsule deliver only cargo to the International 
Space Station to establish a record of reliability before putting hu- 
mans on board. The ESAS states it takes five flights in addition 
to the two test flights to surpass the shuttle safety level of one in 
100. If there were no cargo flights beforehand, the risk of the first 
crewed flight after the two test flights would be approximately one 
in 40, or approximately two and a half times the shuttle. Adding 
cargo flights to ensure safety would only seem to increase the gap 
in U.S. human spaceflight capability. 

So the question I wanted to ask was beginning with Mr. Hanley, 
I understand that the current plans propose putting astronauts 
aboard Ares I and Orion after only a single unmanned flight of the 
final rocket. Can you discuss this decision in light of the ESAS 
original recommendation and what steps are you taking to address 
this concern? 

Mr. Hanley. Certainly. As part of the program’s preparation for 
its program preliminary design review that will be next year, next 
calendar year, we are putting together our integrated test and 
verification plan. The flight in which the crew will launch will be 
informed by that plan and it requires an understanding of the test 
program, and Joe talked about this earlier, the test program that 
goes into verifying that these systems will in fact perform the way 
that the designers believe they will. There is a lot of variability in 
the methods one might apply to try to use a crystal ball to predict 
how reliable a particular system will be. Coming up with an abso- 
lute number is very sensitive to the method or the approach, the 
thought process that you use, and that is what we see. So predomi- 
nantly we use these risk numbers to compare alternatives, not nec- 
essarily to inform some absolute number of what the risk level 
really is. So with respect to the assertions made in the ESAS study 
versus what we are doing today, I would invite Joe to maybe com- 
ment because he was integral to the ESAS study. 

Mr. Fragola. And since I wrote that section that you referred 
to, that is a great confusion. If they had only gone to the page be- 
fore, they would have seen that that statement referred to an ad- 
vanced engine on the Orion spacecraft using LOX/methane. What 
we were trying to do was to enhance the reliability, the mission re- 
liability of the lunar missions with a given performance. We were 
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looking at LOX/methane because LOX/methane was able to be car- 
ried through as a launch propellant for Mars. What we wanted to 
show from a safety standpoint was that there was a penalty in im- 
maturity to the system if we chose that LOX/methane option. So 
what you were seeing there was that penalty. If we look at the 
Ares system, Orion system today with the propulsion system that 
is now on Orion, which is essentially the same that is on the space 
shuttle OMS systems and has performed absolutely perfectly on 
the OMS and was also on the lunar module descent engine and on 
the command module serving as propulsion system, the immaturity 
of the system drops to almost zero and now the immaturity of the 
system is based on primarily the second stage of the Ares system. 
And if you look at what it takes for that to get to the equivalent 
of the shuttle, it is between one or two test flights necessary to get 
the equivalent of the shuttle. It is certainly not going to get to one 
in 1,000 at that point but we are looking at trading off versus when 
does it get to the point that the shuttle, which is what we are fly- 
ing crew on today. So the statement in the Sentinel is correct but 
it applied to an option in the ESAS study, not the one that we are 
flying today. 

Ms. Kosmas. Thank you. Unfortunately, I am afraid that ended 
up using all my time, but thank you for the answer and I will see 
to it that that information is passed along. Thanks. 

Chairwoman Giffords. Thank you, Ms. Kosmas. 

For the remaining member for our first round is Mr. Hill. Mr. 
Hill. 

Mr. Hill. Well, thank you. Madam Chairman. I got here rather 
late so I need to get caught up on some of the conversations you 
have been having for the last hour or so, so I will pass on asking 
questions. 

Chairwoman Giffords. Thank you, Mr. Hill. We are glad you 
are here. 

Availability and Economic Viability of Commercial 
Crew Transport 

We are going to begin a second round. We have not had votes yet 
so it is our good fortune today, and while we have all of you here 
we are going to take advantage of it, so I would like to begin. I am 
going to ask everyone on the panel starting with General Stafford 
if you could answer two questions. Taking everything that we have 
learned today about safety and the complexities of what it takes to 
build these vehicles, is the timetable for availability of commercial 
crew transport truly realistic? That is my first question. And the 
second is, given the required steps of everything that factors into 
building these vehicles, do our witnesses believe that would-be 
commercial crew transport service providers be able to garner suffi- 
cient revenues from non-NASA passenger transport services to re- 
main viable over this time period as well? So those are the two 
questions that I have. I know that you gentlemen come from dif- 
ferent aspects and different angles of this industry. You know, the 
backdrop of course is in light of the fact that we have a diminished 
budget. I mean, if we had sufficient budget to do everything, I am 
sure that all of us on this Committee would agree that this is 
where we want to invest our money, I mean, because the benefits 
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that come from both the private and public space sector is out- 
standing and much underappreciated. But given the fact that we 
have finite resources, I think that these are two important ques- 
tions. I would like to begin with you, General Stafford. 

Lt. Gen. Stafford. Thank you. Madam Chairman. First, on the 
safety for the commercial crew delivery for government crews, the 
observations in the Augustine report said 2016. If they would go 
to meet the requirements starting with safety and mission assur- 
ance, I think that would be a very tough goal to make it. They 
could possibly make it. But on the other hand, when they said 2017 
for the Ares Orion, I do not understand that. It should be far soon- 
er than that. 

As far as other customers that the commercial crew delivery cor- 
poration would deliver to, right now, other than the space station, 
I know of no other ones that would be there at this time. 

Chairwoman Giffords. Thank you. General. 

Dr. Fragola? 

Mr. Fragola. Well, certainly the challenge is a potential chal- 
lenge that could be met by the commercial crew. It is a question 
of what the uncertainty involved is, and from my perspective based 
upon history, it would be very uncertain that we could meet that 
kind of a date. Certainly the type of work that has gone on in Ares 
since the time of ESAS to today to ensure safety in that vehicle is 
equivalent to what you would have to do on any vehicle, whether 
it would be a Titan or a Delta or an independent commercial 
launcher. 

I would like to go back to that one thing that I said before to an- 
swer Mr. Rohrabacher. There is a big difference between a crew 
payload and a payload that is not crew because after the accident, 
the payload that is not crew doesn’t care a whit about what hap- 
pened but the payload that is crew cares a lot, so what we have 
to do is to design the abort system integral to the failure mecha- 
nisms that are on that system and that requires a much greater 
knowledge of your launcher than they have today with commercial 
payloads or for Air Force payloads. 

Chairwoman Giffords. Thank you. Doctor. 

Mr. Alexander. 

Mr. Alexander. Thank you. I believe that the timetable as laid 
out by the Augustine Committee is realistic. That is seven years 
from now. Certainly I don’t believe that the human rating of the 
launch vehicle is the long pole in the tent. I believe it is the devel- 
opment of a capsule to take people to the station and back. There 
are companies that say they can do it in significantly faster time 
than that and there are others that say it will take at least that 
long, and I wouldn’t, you know, pretend to be the expert that is 
going to predict exactly what it will take. However, I do know that 
it will take longer if we do not start now. As I said before, I don’t 
believe that, you know. Ares Orion and commercial crew are com- 
petitive. I think that you need to do both, so it is not about which 
one gets there first necessarily but I do believe that because serv- 
icing the station is a simpler mission, less complex, and you can 
use demonstrated reliable launch vehicles that will need modifica- 
tions but not extensive modifications because they have a track 
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record of 19 successful launches or heritage of 19 launches, that 
that is a realistic timetable. 

Second, as to whether there are viable revenues from non-com- 
mercial or non-government sources, there is already a market for 
private spaceflight participants that have been paying between $25 
million and $35 million to fly on the Soyuz. Those people spent 6 
months of their lives learning Russian, training on Russian sys- 
tems separated from their revenue-generating jobs that they have. 
I believe that if the United States industry were able to offer that 
capability, you would have a far greater number of people willing 
to take that on and pay that kind of money. Also, you know, with 
the hope that with commercial, the price comes down, that market 
becomes bigger, but there is also a market for other U.S. industries 
and other activities, microgravity research, et cetera, in space that 
is not efficiently served by NASA and the NASA process and I 
think that commercial will be able to find additional revenues 
there. They certainly will not be the bulk of revenues in the begin- 
ning but there is a place for — or there is a demonstrated market 
there now that will only grow. 

Chairwoman Giffords. Thank you, Mr. Alexander. 

Mr. Marshall. 

Mr. Marshall. Regarding the two questions, is the timetable re- 
alistic, in the ASAP’s 2008 annual report, we made a statement 
that said that there is no evidence to suggest that the use of a com- 
mercial space industry vehicle can significantly close the gap. We 
stand by that statement. We have no evidence that would say oth- 
erwise. I think the term that is of importance is “significant.” 

Orbital Sciences and SpaceX 

The second is, given the steps, is there sufficient revenue to pro- 
vide survivability. I mentioned to you in my opening statement 
that we have gone to both SpaceX and to Orbital Sciences. We were 
at Orbital Science this week, and during the presentation we asked 
their senior management if they had done a market analysis to 
find other revenue sources that would address this specific issue. 
The answer was no, we have not done the market analysis because 
we see no viable commercial requirement at this time. Now, I am 
not trying to put words in their mouths. That is just the way I in- 
terpreted it. I would think that that is a fairly accurate statement. 

Chairwoman Giffords. Thank you, Mr. Marshall. 

Mr. Hanley? 

Timetable: Commercial Crew Transport 

Mr. Hanley. With respect to timetable, I can really only speak 
to what I would see as the challenges, and Joe has touched on 
them. I think it is — and I would agree with Mr. Alexander, I think 
it is about the spacecraft, it is about the launch abort system as 
well as the rocket. Joe, I think, spoke quite eloquently about how 
it is an integrated system. It needs to be designed altogether as an 
integrated system to be able to maximize crew safety, and I think 
that is where the real challenges lie for other developers. That is 
certainly where our focus has been for these four years, and so 
what kind of — what that does to the timetable or not I really 
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couldn’t comment, not having detailed knowledge of the plans and 
the alternatives. So with respect to revenue, I hope to mayhe live 
to see the day when I can buy a ride, but as far as revenue, I really 
don’t have a comment. 

Chairwoman Giffords. Thank you, Mr. Hanley. 

Mr. O’Connor. 

Mr. O’Connor. I haven’t done an independent assessment of 
these schedules but I can just tell you as a safety guy watching 
program and project managers and contractors predict schedules 
for years, as I watch that happen, I have seen that sometimes they 
miss and some of the things that cause them to miss schedules is 
the down time after failure. Another thing is the lack of integration 
up front. If you don’t do good integration up front, then you pay 
for it later and it takes time. I remember after Challenger we tried 
to retrofit an escape system on the Challenger and we fiat couldn’t 
do it. So it wasn’t even a matter of schedule. It was just too hard. 
So getting early, getting things done quickly in the front part of a 
program that you are going to need later on can help with schedule 
because it takes much longer to fix things than to do it right in the 
first place, so that is all I can add to that, and I really haven’t 
looked at commercial revenue at all so I wouldn’t comment on that. 

Chairwoman Giffords. Thank you. 

Mr. Olson. 

Ares Program: Safety and Future Impact 

Mr. Olson. Thank you. Madam Chairwoman, and this is a ques- 
tion for all of you or anybody who wants to comment, but I want 
to get back to some of the issues, some of the concerns we were 
talking about about the Ares program, and as you all know, a cou- 
ple of weeks ago we had a very successful test of Ares I-X, a vehi- 
cle that had over 700 sensors on board to measure many of the fac- 
tors that that spacecraft was feeling as it went through its ascent, 
and I just want to get some comments from all of you. How does 
that level of technology that we have now, how does that increase 
our ability to develop a vehicle safely and not have necessarily the 
flight test that we had to have in the past, and one sort of side 
question to that is, how does development of Ares I help speed up 
the development of Ares V, you know, basically the same system 
in many, many ways. Does that allow us to accelerate the develop- 
ment of the Ares V? Mr. Hanley, you first. 

Mr. Hanley. Well, the way I think of it is that by developing 
Ares I we are in fact developing parts of Ares V today so we 
aligned our strategy purposefully back four years ago. If you will 
recall, coming out of the Explorations System Architecture Study, 
the Crew Launch Vehicle, as it was called at that time, the Ares 
I was called, was a four-segment solid plus an upper stage that uti- 
lized the space shuttle main engine and we purposefully at the 
agency level made a decision to change to the five-segment and J2- 
based upper stage because we wanted to leverage the early invest- 
ment of dollars we were making toward building the heavy lift 
launch vehicle. So that is the synergy between Ares I and Ares V 
that a lot of folks miss. So we are building part of the Ares V rock- 
et today with the five-segment booster with the J2X engine. We 
even purposefully will be looking to play forward the investment 
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we are making in the avionics that guide the rocket as well. The 
hurdles that we face with building a larger rocket really focus on 
the core stage, the massive core stage in that system, and those are 
investments we have yet ahead of us. 

Mr. Olson. Thank you for the answer, Mr. Hanley. 

Any other panel member care to comment? Okay. Well, that was 
my last question. Madam Chairwoman. I yield back the balance of 
my time. 

Chairwoman Giffords. Thank you, Mr. Olson. 

Dr. Griffith, please. 

COTS vs. Constellation Program 

Mr. Griffith. Thank you. Madam Chair. 

Some in NASA have suggested that by taking on the risk of pro- 
curing maybe a commercial service to deliver astronauts to the 
space station that we will lower our costs and provide greater 
launch capability, yet the COTS program was to be a proving 
ground for commercial sector to deliver cargo to the station but to 
my knowledge, that has yet to happen. I don’t know that any of the 
commercial orbital transportation service providers or the funding 
of that has been able to deliver what we had hoped that it would. 
It seems that we should require our commercial providers to prove 
their ability to deliver on these contracts or on these ventures that 
taxpayer funds have funded. And so my question is, and anyone 
can answer this, the commercial orbital transportation services, 
what evidence do we have, what hard evidence do we have that we 
can rely on them to deliver manned spaceflight in a more timely 
way than we have with our Ares I or Constellation project? Is there 
any evidence? 

Lt. Gen. Stafford. Mr. Griffith, as I said, I did extensive exam- 
ination of the Augustine report and I knew many of the members 
and have talked to them, I told them I would be giving testimony 
here today. In fact, this morning I talked to Dr. Crowley twice on 
my cell phone on his idea of multiple providers and his assumed 
cost on those commercial government crew delivery vehicles, and 
then I checked with Mr. Hanley here and so it was a wide variance 
between their assumptions and what we have, and also I found 
that there was also, on the Augustine Committee there was some- 
what of a wide variance of opinions among the committee members, 
sir. 

Mr. Griffith. Thank you. 

Mr. Alexander? 

Mr. Alexander. Thank you. The question of whether to prove 
cargo first, if you will, before putting people on top, I certainly 
agree with that in terms of demonstrated reliability. Those cargo 
systems that are being developed are being developed right now 
and those will fly many times before people are put on those rock- 
ets or any new system goes on an Atlas V which already has a 
demonstrated reliable launch record. The question of whether cargo 
has delivered, you know, the programs has not been completed yet 
to first flight. They have not had their demonstration flights yet. 
As Mr. O’Connor said, every space program seems to have cost 
growth and schedule risk, or schedule drift, if you will. I would put 
the record of those cargo demonstration programs up against the 
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record of government space program developments in terms of cost 
growth and schedule risk, and I think they would compare very fa- 
vorably. So whether they have met all their milestones exactly as 
they originally planned four years ago, I am not the expert to 
speak to that but they are certainly progressing well as evidenced 
by the fact that NASA is paying on those milestones and is in 
agreement that things are progressing well. So I do believe that 
those programs are functioning well. I believe that, you know, dem- 
onstrated launch vehicles and cargo missions will happen before 
crew missions happen, and again, as I said before, the longer we 
wait to start that process of crew activities or commercial crew ac- 
tivities, the longer it will take us in terms of shortening any gap 
or when we actually would be able to deliver that service. 

Mr. Griffith. Thank you, Mr. Alexander. 

Risk Assessment: Commercial Vehicle 

Dr. Fragola, are you involved in the risk assessment whether it 
be the risk assessment of a commercial vehicle for delivery of cargo 
or the development of a commercial vehicle for the delivery of our 
astronauts? 

Mr. Fragola. At this moment, I have no involvement in that. 
However, as part of the review, the independent review, I did look 
at the alternative launch vehicles, particularly Delta IV heavy. As 
part of the ESAS study, we did look at the Atlas V single core. By 
the way, it is important to point out as Mr. Alexander has men- 
tioned, the Atlas with the 19 successes is a single-core vehicle with 
a rather limited payload capability to orbit as compared to the pay- 
loads that we are talking about on the Ares I. There is no doubt 
that the single-core vehicle would be more reliable than a triple- 
core Atlas but a triple-core Atlas doesn’t exist today. We don’t have 
an Atlas heavy. The option would be a Delta IV heavy and that 
was evaluated and seemed to be about a factor of two to a factor 
of three less safe than the Ares. But one of the things I wanted to 
point out, as I mentioned, immaturity is very important. One of the 
arguments against the Ares is, well, the first stage of the Ares is 
not equivalent to the SRB on the shuttles, it is a five-segment 
booster. I would point out that we are recovering the booster first 
stage. That is not going to occur on any of the commercial alter- 
natives and so the learning we can get from inspection post flight 
is incredibly important to advancing the maturity of the vehicle 
and to proving that we have carried over the 255 successful 
launches of the SRB on the shuttle and the Ares I. 

Mr. Griffith. Thank you. 

Thank you. Madam Chair. 

Chairwoman Giffords. Mr. Hall, please. 

Mr. Hall. Madam Chairman, I think you will leave the record 
open for us to write and make inquiries if we need to. With that 
understanding, I will yield my time to Mr. Rohrabacher. 

Ares, Delta, Atlas: Comparison 

Mr. Rohrabacher. Thank you very much. I just want to get into 
this thing about making some comparisons in terms of the alter- 
natives that we have, and Dr. Fragola, I appreciate your comments. 
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I think we might disagree but I am really interested in learning 
from you on this because you know much more about it than I do. 
I understand that. But when you are suggesting to us that we have 
to look at the many uses that have been put through and the ac- 
tual track record of the first stage of the Ares, that really doesn’t 
count, does it? Because the system itself can’t be certified as being 
reliable until the second stage, which has never even been built 
yet, is put into the system. Isn’t that right? So with that type of 
analysis, there is not even a comparison between the Delta and 
Atlas in reliability because the Ares doesn’t even have their second 
stage built yet, which the system will fail if the second stage 
doesn’t work. 

Mr. Fragola. That is correct. The second stage is the risk driver 
and that is the reason why we chose a J2X system which has herit- 
age both in the RS-68 engine and in the J2 engine and the J2- 
S engine. It is true that the stage and the engine as an integral 
sum has not been 

Mr. Rohrabacher. You say risk driver, but that risk has already 
been assessed in terms of Atlas and Delta. We have no way to even 
assess whether that risk — what that risk is because we haven’t 
even built the second stage 

Mr. Fragola. Even 

Mr. Rohrabacher. — to get the system that you are talking 
about. 

Mr. Fragola. Again, the equivalent payload, even on the Delta 
IV heavy, we would have to modify the second stage of the Delta 
IV heavy. There is no way we can get the payload that we get so 
we would have to have 

Mr. Rohrabacher. Well, that is if you want a payload that big, 
but if you are having medium-sized payloads, it has already been 
proven. 

Mr. Fragola. If you were to decrease the requirements signifi- 
cantly down to the payload like Mr. Alexander has spoken to, then 
you would have to — ^you would be able to use the existing second 
stage 

Mr. Rohrabacher. And you might want to have a few more 
launches rather than having to launch everything on one rocket. 
That doesn’t — it doesn’t make sense to me that you just have to 
have everything in a big payload carrier. 

Orion Space Craft 

Let me get to beside the rocket, and I only have a couple minutes 
left here. I would like to look at the actual spacecraft, the Orion 
spacecraft, as compared to the alternatives there as well, and 
again, I am not opposed to the Ares Orion system because I do be- 
lieve in the moon project. I just think that if we try to do every- 
thing — the moon project has to be the same thing that we rely on 
for a low earth orbit. That may not be the best deal for the tax- 
payers and it may not be as reliable and it may not be as far so 
that we can bring it into play, but I understand Boeing — Boeing is 
in my district, and I seem to remember that they are developing 
this other spacecraft, and why is it that spacecraft — in terms of 
safety, is it more — is the Orion safer than what Boeing is pre- 
senting to us? 



99 


Mr. Fragola. I guess I am not familiar with the particular Boe- 
ing spacecraft. I know some other spacecraft. Which one are you re- 
ferring to? 

Mr. Rohrabacher. Well, it is in development right now. I under- 
stand that it hasn’t been flown yet, but I understand that they are 
proposing this. Maybe I 

Mr. Fragola. I can’t comment on a design I haven’t seen. I 
haven’t seen that yet. If someone would present the design, I could 
look at it. 

Mr. Rohrabacher. And do the NASA people know anything 
about a Boeing proposal on this? So I am wrong then, I have been 
misinformed then that the commercial spacecraft companies are ac- 
tually proposing a spacecraft that would be similar to Orion. 

Mr. Fragola. Well, we visited — similar to Orion, no, but we did 
visit a few people who had mockups of vehicles, but mockups of ve- 
hicles, we had them in ESAS four years ago. I mean, between that 
and a real design is a far way to come. 

Mr. Rohrabacher. And Mr. Alexander wants to mention some- 
thing here. 


Commercial Crew Development Program 

Mr. Alexander. If I might, I believe that Boeing has teamed 
with Bigelow Aerospace to propose something under NASA’s 
CCDev, or commercial crew development program. So that is at 
this point probably a concept 

Mr. Rohrabacher. It hasn’t actually been designed out and 

Mr. Alexander. Right. They were one of the, you know, finalists 
for the Orion Crew Exploration Vehicle. Lockheed Martin ended up 
winning that program. I am sure that they have — their current de- 
sign has a lot of heritage to what they were proposing for Orion 
but they were not the winner. 

Mr. Fragola. By the way, we saw that vehicle and that vehicle’s 
design requirement requires you to rendezvous and dock within the 
first orbit in order to meet the payload, and that means that if you 
don’t have proper rendezvous and you don’t dock the first time, you 
deorbit, and Bigelow was willing to accept that because he was a 
commercial enterprise, but to do that on the station, I don’t know 
that that’s something that is prudent. If he does that, he limits the 
payload, limits the design. He also doesn’t have to carry the things 
to sustain the crew for two or three orbits and that significantly 
reduces the mass of the 

Mr. Rohrabacher. Thank you very much. 

Thank you. Madam Chairman. 

Chairwoman Giffords. Thank you, Mr. Rohrabacher. 

Ms. Edwards. 

Training for Commercial Space Operatives 

Ms. Edwards. Thank you. Madam Chairwoman. I just have a 
question and it goes to the testimony that you presented. General 
Stafford, with regard to training and your indication of how in- 
volved and important it is for the crew to really be involved in 
training that simulates off nominal conditions and also, you know, 
the number of hours that are spent with regard to safety in every 
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detail. And so I wonder if you could actually speak to what you 
might identify as some of the challenges presented for training 
with commercial space operations. 

Lt. Gen. Stafford. Ms. Edwards, to launch, rendezvous and 
then dock with the International Space Station, you would have, 
you know, working with the spacecraft simulator and mockups and 
then you also have integrated simulations with the mission control 
center that, you know, has control of the International Space Sta- 
tion. So you would have to go through the contingencies and so it 
would be a whole series of issues and that would start with a whole 
series of just to start with, using the launch abort system, the re- 
covery, what action the crew would take, egress from it. And so 
also on these vehicles as they are being built, we are talking, I 
think, approximately, Ms. Edwards, two and a half flights per year, 
if I am correct, that the crew would probably be there at the fac- 
tory when the spacecraft was being built too to understand it. But 
also in the simulations, it would be just repeat simulations and 
there is a profile for this and it requires really hundreds of hours. 

Ms. Edwards. And do you think that that profile changes in any 
respect with what are essentially sort of off, you know, outside of 
NASA operations? And I also wonder if Mr. Alexander could speak 
to this question. 

Lt. Gen. Stafford. Well, if it is outside of NASA operations, I 
would assume it would not go to the ISS because the requirements, 
you know, you have to go to rendezvous and dock with the ISS, a 
strict number of requirements. In fact, I was involved with some 
of that, having worked with the investigator with the Progress col- 
liding with the Mir there on the Shuttle-Mir program then. So I 
think NASA would be involved there, and then you have, you 
know, particularly the commander and the pilot would have to be 
deeply involved and go through this and maybe people just along 
for the payload specialist or mission specialist for the ride would 
not have to undergo near that many but the one that is the com- 
mander and the pilot would definitely have to undergo hundreds of 
hours on that. 

Ms. Edwards. Mr. Alexander? 

Mr. Alexander. Certainly a rigorous testing program and train- 
ing program would be instituted for any commercial crew mission, 
whether it is a commercial mission just to low earth orbit or wheth- 
er it is carrying NASA astronauts to the space station. So obviously 
everybody on board the vehicle is going to have to go through a rig- 
orous training program, and certainly the pilot and commander 
would be much more rigorously trained than anybody that is just 
simply a participant on the flight. 

I think in a broader context, you know, right now for any U.S. 
human spaceflight mission throughout our history, it has been a 
mix of government through NASA and industry, U.S. industry, 
building things, and the relationship has been one of a seamless, 
integrated relationship between NASA and industry, you know, a 
certain contractual environment. What we are talking about for a 
commercial crewed program that would fly NASA astronauts is still 
going to involve an intimate relationship between NASA and indus- 
try. Some of that relationship will change based on historical pat- 
terns. But it is certainly not one without the other, and I think it 
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would be a mistake to assume that from a commercial perspective 
we expect to develop something, throw it over the transom and 
have NASA just accept it. NASA is going to be there every step of 
the way. They are going to be intimately involved and that cer- 
tainly will be true for training of NASA astronauts but will also be 
true in the design, testing and production processes. 

Ms. Edwards. So you don’t envision any significant change to 
training protocols and requirements with a venture towards com- 
mercial operations? 

Mr. Alexander. I am not an expert on what those are today but 
there would certainly be rigorous training and there would cer- 
tainly be agreement between NASA and the private sector about 
how that is going to happen and what is expected such that by the 
time a NASA astronaut is on board that vehicle, they are not only 
capable of flying it and capable of flying it in off nominal conditions 
and abort scenarios but that NASA at the highest levels all the 
way up to the Administrator and through Bryan O’Connor have the 
confidence in that system and the overall system capability includ- 
ing the people involved. 

Ms. Edwards. Thank you. Madam Chairwoman. 

Chairwoman Giffords. Thank you, Ms. Edwards. 

Ms. Kosmas, please. 

SoYuz Space Craft: Concerns Moving Forward 

Ms. Kosmas. Thank you. Madam Chairman. 

I wanted to chat with you all a little bit about the Soyuz that 
is intended to be used during the gap. I know, Mr. O’Connor, you 
spoke earlier about the history and the fact that not that much 
combined testing was done early on and that we made a decision 
as a Nation to send an astronaut anyway. But I think we are a lit- 
tle more enlightened now perhaps. As you know, following retire- 
ment of the shuttle, NASA is planning to rely solely on the Soyuz 
for astronaut transportation to and from the International Space 
Station, and this will probably be, from discussions we are having 
right now, for at least five years. So I would like to ask. General 
Stafford, you can answer it or Mr. O’Connor, last year the Soyuz 
experienced a few rough landings due to malfunctions, and can you 
discuss NASA’s assessments following these incidents whether they 
were involved in the assessments following the incidents and the 
decision to continue to use the Soyuz? The other question which I 
will go ahead and ask now is, are we now — is the Soyuz now re- 
quired to meet our U.S. standards for quality, safety, environment, 
wages of workers, financial accountability and engineering prac- 
tices? So are they accountable to us in the same way that we would 
expect our commercial operations to be or that we would expect 
NASA itself to meet? I would appreciate if you could address that 
since it does appear that that is our alternative during the five 
years. General? 

Lt. Gen. Stafford. Thank you, ma’am. As the chairman of the 
ISS Advisory Committee, we meet with our Russian colleagues at 
least twice a year and they have conference calls once a week con- 
cerning issues that would arise, and on that the Soyuz first flew 
in 1967. There have been two fatalities, one in 1967 and one in 
1971. Since 1971 they have had 100 percent reliability. The basic 
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first stage flew 52 years ago. The second stage in the Soyuz has 
been — is 42 years old. Since 1971 they have had 100 percent suc- 
cess. They did not meet all of our criteria. In fact, I am the only 
one on the committee here who has been in the Soyuz and I did 
that first one on the Apollo-Soyuz and we had them change a cou- 
ple of their systems before we would fly with them and there has 
been follow-up since then, and I think Mr. O’Connor has outlined 
the fact of what they do with their safety and they are very at- 
tuned to it, and we are completely informed about that. As far as 
the two reentries on the delay of the service module, the separate 
and all that, they have taken into account, explained that, and so 
to me, it should be a situation that is solid again. I would rather 
have us fly on our spacecraft, ma’am, as soon as possible and if we 
had the budget we could do that. 

Ms. Kosmas. Mr. O’Connor? 

Mr. O’Connor. Ms. Kosmas, we were quite concerned with these 
landings. In fact, Peggy Whitson was in one of those and it was a 
pretty interesting ride for her, and would be for anybody, and so 
we offered to help the Russians in their investigation. They put to- 
gether a commission to take a look at it. General Stafford and his 
counterpart in Russia have a committee that oversees the safety of 
the Soyuz flights and they were interested. We were all asking 
questions. We did our own independent assessment of what we 
thought might have happened based on what we know about 
Soyuz’ design and we compared notes with the Russians. In the 
end, they didn’t get to the root cause the way they wanted to but 
they fixed all the possible things that could be the real root cause 
of this thing and they fixed those things to our satisfaction. They 
shared a lot of information with us, way more than they used to 
in the old days. There are some times when we and the Russians 
do not agree on something like, for example, the relative risk of 
some issue that has come up, but by and large they are very open, 
and when we don’t agree with one another, we lean back on their 
demonstrated reliability, the quality of their workforce and the re- 
lationship our engineers have with theirs over a period of about 15 
years now. 

As for how we are planning to work with them in the future, we 
don’t retroactively assign all of our human rating or any other kind 
of requirements on the Russians to participate with them as part- 
ners. We have an MOU with them. We have signed up to extend 
the MOU to fly our astronauts and those other astronauts from 
Japan, Canada and Europe who depend upon us for transportation. 
It is the Russian transportation that we will be providing for them 
as well. So we take them under our wing. We take our responsi- 
bility very seriously. 

Ms. Kosmas. Thank you. Unfortunately, the time is up. 

Chairwoman Giffords. Thank you, Ms. Kosmas. 

Because we have a situation where we have time yielded to Mr. 
Rohrabacher, we actually now will go back to Mr. Rohrabacher, but 
I would like to introduce Ken Bowersox, an astronaut who has ex- 
perience in both shuttle and Soyuz. It is good to see you today, sir. 
Welcome to our Committee. 

Mr. Rohrabacher. 
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Addressing the Gap in Human Spaceflight 

Mr. Rohrabacher. Thank you very much, Madam Chairman, 
and we are in a little time bind here and I will try to be as quick 
as I can. Let me get to some fundamental issues here. 

The basic challenge that we are facing is to close the gap that 
will be created when the shuttle is grounded as soon as possible 
and with as less risk as possible, and that is the challenge that we 
have. The challenge isn’t going to the Moon. Right now the chal- 
lenge we face is closing that gap. In terms of servicing the space 
station and low earth orbit, will the Delta system and the Atlas 
system, those rockets as they are now configured, will they be able 
to lift the payload necessary to deliver either a payload or crew to 
the space station or we will have to reconfigure those rockets? Any- 
body? 

Mr. Alexander. Absolutely those vehicles as they are designed 
now have the performance capability to take a capsule for people 
or cargo to the space station. 


Ares 

Mr. Rohrabacher. Okay. When it comes to Ares Orion, they 
need to have something else that is developed and which is actually 
invented or, so to speak, a second stage or that system cannot de- 
liver a capsule to the space station. Is that correct? 

Mr. Fragola. If it were the Orion capsule, it could not do that. 
For a degraded with payload that is much less than Orion and we 
would do it on a single-core Atlas, we would have to use probably 
an Atlas 431, which includes three solid rocket boosters wrapped 
around a central core, and I doubt that that would be able to pass 
snuff on safety because in the OSP days when Bowman did his re- 
port, comprehensive report of alternatives, they showed that wrap- 
ping solids around a liquid core is 

Mr. Rohrabacher. Okay, but I am not talking about Atlas here. 
I just want to get the information about the Ares. We are going to 
have 

Mr. Fragola. The Ares payload is significantly better than any 
of those alternatives. 

Mr. Rohrabacher. Okay, but it depends on developing a second 
stage that doesn’t exist. 

Mr. Fragola. You would need a second stage for the Delta IV 
heavy as well to carry the payload. If you changed the payload or 
you changed the 


Delta IV and Atlas 

Mr. Rohrabacher. Does the Delta IV — you are saying that the 
Delta IV cannot carry a payload to the space station without some- 
thing new being put onto the Delta IV? I am trying to get at 

Mr. Fragola. Yeah, for the Orion spacecraft on the Delta IV 
heavy, we would need a new upper stage. We would either have to 
four RL-lOs or 

Mr. Rohrabacher. We just heard the testimony from Mr. Alex- 
ander — 

Mr. Fragola. He is speaking of a much smaller payload. 
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Mr. Rohrabacher. Well, listen, I am not talking about — ^you 
know, maybe we have to fly more missions to get the same level 
of payload. I am just talking about getting an actual payload to the 
space station. You might have to — it might actually be less risky 
to fly three Delta missions there with a rocket that currently we 
have than to rely on a rocket that has a heavier lift but you have 
to build a whole new second stage which may or may be able to 
be built. Until that thing flies, we don’t even know if it is going 
to function. 

Mr. Fragola. I would respectfully suggest that history shows us 
that the first-stage problem is the serious problem, and on the 
Delta 431, which is the only single core that can carry the payload 
that Mr. Alexander is talking about, you would have not only a sin- 
gle core but you would have three solid rocket boosters, and the 
Delta II accidents and the Delta 34D accidents show how impor- 
tant the interaction between the solids and the liquids are in a sur- 
vivable condition. You would create a condition if you lost the solid, 
that would engage the 

Mr. Rohrabacher. I have only got a couple more seconds. But 
the Delta — from my understanding, the Delta and Atlas have a 
very good track record, and what we are saying is, we have a track 
record to actually get things to the station, close that gap as com- 
pared to an Ares. If our strategy is to depend on that, it is to de- 
pend on a second stage that hasn’t been built yet, and I will have 
to say from my experience, any time you don’t have a piece of tech- 
nology that is built and functioning, you can have the schedule go 
way back and the costs go way up so we wouldn’t be able to close 
that gap. 

Mr. Hanley. And that is exactly why — ^you mentioned Boeing 
earlier. 

Mr. Rohrabacher. Yes. 

Mr. Hanley. That is exactly why we have Boeing on contract to 
be producing the upper stage for Ares because they have the cor- 
porate knowledge and the heritage in producing such systems of 
similar scale and they are bringing — doing a fantastic job bringing 
their expertise 

Mr. Rohrabacher. It was a good decision to take Boeing 

Chairwoman Giffords. Mr. Rohrabacher, we only five minutes 
left in the vote so I am going to have to cut you off. 

Mr. Rohrabacher. Thank you very much. 

Chairwoman Giffords. Mr. Hill, my apologies. Okay. We are 
coming down to the minute. We are going to run over. I want to 
thank our witnesses today. It was absolutely brilliant testimony. I 
think we learned a lot. This won’t be the first time that we address 
safety. We will come back to this because it is so critically impor- 
tant. 

You know, I am sorry Mr. Hall can’t be here for the end because 
I really believe what he said initially is so compelling and really 
reflects the sentiment of the Congress. We are strongly committed 
to provide a safe way for our astronauts to go to space and to travel 
back, and I have to say that I find the level of safety that has been 
planned for Ares and for Orion and the steps being taken to build 
safety into this Constellation program from the very beginning to 
be something that we have been proud to support for the last four 
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years. While I continue to have an open mind, I look to the testi- 
mony of Mr. Marshall provided and I believe I quote you here, “The 
ASAP believes that if Constellation is not the optimum answer, 
than any new other design system has to be substantially superior 
to justify starting over.” Based on what we have heard today, and 
there is more in your written testimony, I see no justification for 
a change in the direction on safety-related grounds. Instead, I am 
in fact impressed with the steps that have been to infuse safety 
into Constellation. It is something that of course we are very proud 
as a country we have been able to achieve this. 

That being said, I don’t intend, and I hope that people don’t 
think that is a competition of commercial versus NASA. It is sim- 
ply not that. We are all really excited and welcome the growth of 
new commercial space capabilities in America. Like Mr. Hanley, I 
too want to go to space and welcome the opportunity to do that 
someday, not for $30 million but maybe if the cost comes down. But 
currently I do not see those capabilities as competition with, as Mr. 
Alexander talked about, but rather complementary to our govern- 
ment systems that are currently under development. Whatever the 
Congress may decide to do with the question of additional incen- 
tives to the commercial space industry, of course, in this time of 
constrained budgets is something that really concerns all of us and 
this is why this discussion today has been so important. It is a 
question that needs to be decided on its merits, again, not on pas- 
sion, not on what ifs but the actual reality of what is achievable 
and what can be documented. This is not a substitute for a contin- 
ued commitment to the Constellation system that offers incredibly 
the safety benefits that we have heard in the testimony today. 

So thank you, gentlemen, for being here and to the Members of 
Congress, of course, for being here. With that, I will bring this 
hearing to a close by stating that the record will remain open for 
two weeks for additional statements from the members and for an- 
swers to any follow-up questions that the Subcommittee may ask 
of the witnesses. The witnesses are now excused and the hearing 
is now adjourned. Thank you. 

[Whereupon, at 12:30 p.m., the Subcommittee was adjourned.] 
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Answers to Post-Hearing Questions 

Responses by Mr. Bryan O’Connor, Chief of Safety and Mission Assurance, National 
Aeronautics and Space Administration 

Questions submitted by Chairwoman Gabrielle Giffords 

Ql. In your prepared statement, you cite that NASA is beginning development of a 
more concise set of human rating technical requirements applicable to NASA de- 
veloped crew transportation systems as well as commercially -developed crew 
transportation systems or use by NASA. 

• When do you envision these more concise human rating technical requirements 
will be defined so that commercial stakeholders can understand NASA’s 
needs? 

• Is solely meeting these technical requirements the litmus test NASA should use 
to determine if a commercial transportation system is safe for its astronauts 
to use? 

Al. NASA has formed a team to develop an implementation plan for human rating 
of commercially-developed crew transportation systems. This plan is based on 
NASA’s approach to safety risk management and the existing Agency human rating 
philosophy. This plan will clarify NASA expectations, including technical require- 
ments, and will be derived from: NASA Procedural Requirements 8705.2 (Human- 
Rating Requirements for Space Systems); Space Shuttle Program 50808 (ISS to 
Commercial Orbital Transportation Services Interface Requirements Document); 
and, other existing NASA requirements documents such as NASA Directives, NASA 
Standards, NASA adopted standards, the Exploration Architecture Requirements 
Document, the Constellation Architecture Requirements Document, and the Con- 
stellation Human Systems Integration Requirements. 

NASA released the preliminary plan using a NASA Request For Information on 
May 21, 2010. Responses were due on June 18, 2010 and NASA is in the process 
of reviewing and evaluating the responses. NASA plans to finalize the Commercial 
Human-Rating implementation plan in time to support an open-competition when 
NASA pursues the development phase of commercial crew transportation systems. 

Meeting NASA Human-Rating requirements is an important part of the overall 
process but not the sole test NASA will use to determine if a commercial transpor- 
tation system is safe for NASA astronaut transportation. Any system destined to op- 
erate in the proximity of the ISS will be subject to the ISS “Visiting Vehicle” re- 
quirements, for example. 

NASA will define, as part of this plan, the appropriate level of ongoing govern- 
ment visibility into the development, testing/engineering analysis, production and 
operation of all launch vehicles and spacecraft that carry NASA astronauts. NASA 
will also define its role in hazard and risk analysis/acceptance, as well as design 
and operational certification and flight readiness. 

Q2. The Shuttle’s operational costs have declined in the past few years. 

a. Do lower operational costs necessarily mean less safety? 

b. What lessons learned from the way NASA is operating the Shuttle may prove 
useful to how your office will oversee the safety of future space transportation 
system, be they government or commercially-provided? 

A2. Although the overall annual Shuttle budget has declined over the past few 
years, it should not be interpreted that the decline is in the “operational costs” of 
conducting Shuttle missions. 

After the Columbia accident in 2003, the Shuttle Program budget was signifi- 
cantly increased as NASA pursued parallel paths to address findings and rec- 
ommendations of the Columbia Accident Investigation Board. The related costs for 
design, development, test and certification peaked in the 2004-2005 timeframe, and 
have gradually declined since. 

As we approach the retirement of the Space Shuttle Program, NASA is gradually 
closing out the Shuttle Program’s production capabilities as the last needed hard- 
ware and subsystems are making their way through the production pipeline. This 
has led to a further reduction of cost. 

These cost reductions have not and will not impact the focus on safety by the Pro- 
gram for the remaining flights. 

Once NASA has developed a strategy for acquisition of any new launch, entry, 
and/or emergency deorbit capability or service, the Agency must define its own role 
in ongoing management oversight and technical insight, including certification of 
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the design and operation, and readiness of the team for flight, as well as ongoing 
role in problem resolution, sustaining engineering, hazard and risk analysis/accept- 
ance. These decisions will be based on a number of factors, most stemming from 
hard lessons learned during Apollo 204, Challenger and Columbia mishap investiga- 
tions and recovery. Examples include: a respect by all involved for the inherent 
risks in human spaceflight, not only in early development phases, but throughout 
the lifecycle; the need for rigorous checks and balance between the developer and 
the “owner” of the technical requirements (Technical Authority); the need for tech- 
nical excellence among the development and assurance work force, the need to in- 
clude flight crew in system development as well as flight test operations safety-crit- 
ical decision-making; the necessity of continually challenging past assumptions and 
engineering models as part of the ongoing risk management process; and, the impor- 
tance of clear roles and responsibilities and good communications in all directions 
as part of a healthy safety culture. 

Questions submitted by Representative Pete Olson 

Ql. Please explain with examples if possible, how NASA uses its human-rating re- 
quirements to tailor the design of a crewed space system such as Ares and 
Orioni 

Al. NASA’s Human Ratings Requirements document (NPR 8705. 2B) applies to the 
integrated flight/ground system, and is based on three key principles: 

1) Human-rating is the process of designing, evaluating, and assuring that the 
total system can safely conduct the required human missions. 

2) Human-rating includes the incorporation of design features and capabilities 
that accommodate human interaction with the system to enhance overall 
safety and mission success. 

3) Human-rating includes the incorporation of design features and capabilities 
to enable safe recovery of the crew from hazardous situations. 

For instance, requirements associated with the first principle drive a considerable 
focus on human factors aspects of the design, such as proper layout of cockpit dis- 
plays and controls, and environmental factors such as adequate crew cabin tempera- 
ture and humidity. 

Separately, requirements associated with the third principle stipulate that certain 
abort and or escape capabilities be present. To implement this requirement, signifi- 
cant effort has gone into prelaunch and post landing emergency egress capabilities 
and the design of a launch abort system which would be used to pull the crew cap- 
sule away from the launch vehicle and allow the crew to return to Earth should a 
catastrophic event occur during launch. In light of the Presidential direction for FY 
2011, it is worth noting that the lessons that NASA has learned from all past and 
present systems pertaining to human rating with be utilized, to the best extent 
practicable, in the development of any future vehicle. 

Q2. If the human-rating requirements are the top level requirements, how would po- 
tential commercial providers gain the necessary insight to design a system that 
meets NASA’s requirements'? Similarly, how did NASA get comfortable enough 
to finally certify the Russian Soyuz for human space flight? 

A2. NASA has formed a team to develop an implementation plan for human rating 
of commercially-developed crew transportation systems. This plan is based on 
NASA’s approach to safety risk management and the existing Agency human rating 
philosophy. This plan will clarify NASA expectations including technical require- 
ments, and was derived from NASA Procedural Requirements 8705.2 (Human-Rat- 
ing Requirements for Space Systems); Space Shuttle Program 50808 (ISS to Com- 
mercial Orbital Transportation Services Interface Requirements Document); and, 
other existing NASA requirements documents such as NASA Directives, NASA 
Standards, NASA adopted standards, the Exploration Architecture Requirements 
Document, the Constellation Architecture Requirements Document, and the Con- 
stellation Human Systems Integration Requirements. 

NASA released the preliminary plan using a NASA Request For Information on 
May 21, 2010. Responses were due on June 18, 2010 and NASA is in the process 
of reviewing and evaluating the responses. NASA plans to finalize the Commercial 
Human-Rating implementation plan in time to support an open-competition when 
NASA pursues the development phase of commercial crew transportation systems. 
Meeting NASA Human-Rating requirements is an important part of the overall 
process but not the sole test NASA will use to determine if a commercial transpor- 
tation system is safe for NASA astronaut transportation. Any system destined to op- 
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erate in the proximity of the ISS will be subject to the ISS “Visiting Vehicle” re- 
quirements, for example. Other considerations are demonstrated reliability, the ex- 
tent and quality of the developer’s design, test and evaluation processes as well as 
their production and operations activities. 

NASA will define, as part of this plan, the appropriate level of on-going govern- 
ment visibility into the development, testing/engineering analysis, production and 
operation of all launch vehicles and spacecraft that carry Agency astronauts. NASA 
will also define its role in hazard and risk analysis/acceptance, as well as design 
and operational certification and flight readiness. 

The first step in building confidence in Russia’s human spaceflight in the early 
1990’s was to review lessons from the Apollo Soyuz program. Then NASA worked 
closely with the Russian Space Agency, now ROSCOSMOS to develop technical and 
management relationships and to understand each partner’s roles and responsibil- 
ities for safety in the program. Before NASA began flying NASA astronauts on the 
Russian Soyuz, NASA performed several reviews of the Soyuz design, manufac- 
turing, operations and quality and safety process. Based on these reviews, the trust 
stemming from our government to government relationships, as well as the long 
operational history of the Soyuz (rocket, crew capsule and ground systems), NASA 
developed the confidence to declare the Soyuz system acceptable for US astronaut 
participation. In preparation for potential use of the Soyuz design as a U.S. Space 
Station Freedom crew rescue vehicle, and then later in preparation for the joint 
Shuttle-Mir activity, NASA technical experts, including senior safety engineers, 
spent a significant amount of time talking with Apollo-Soyuz veterans, visiting with 
current Russian counterparts, and reviewing the long history of Soyuz, Salyut, and 
Mir operations in an effort to understand the Russian approach to human 
spaceflight safety. From this they were able to determine acceptability by equiva- 
lence to, if not compliance with, NASA technical standards. In March 1995, Norm 
Thagard became the first U.S. astronaut to launch on the Soyuz. He and the other 
five astronauts who spent time on Mir used the Shuttle for subsequent transpor- 
tation, but they all received training in Soyuz as their primary escape system. The 
next American to launch on a Soyuz was Bill Shepherd, the Commander of the first 
Space Station increment in October 2000. Since then, 14 different NASA astronauts 
have flown on So 3 aiz, bringing the total NASA astronaut trips to 14 up, and 13 
down, several of which were made during the post-Columbia Return-to-Flight time- 
frame. With over 15 years of joint operations NASA has gained confidence in the 
Russians systems and operations, as well as their design and development philos- 
ophy, including not just dependence on system reliability but on crew escape and 
on their extensive system and subsystem testing. 

NASA has not certified, and does not intend to “certify,” the Soyuz for human 
space flight relative to all NASA’s technical requirements. NASA continues to ap- 
prove or clear its participation in each flight by maintaining knowledge and insight 
into the on-going Soyuz program, formally approving NASA and NASA-sponsored 
crewmember participation in its own Flight Readiness Review process, and by par- 
ticipating in the Russian General Design Review process, which is similar to the 
Agency’s Flight Readiness Review process. Additionally, since 1995 a joint Russian 
and NASA committee, the Space Station Advisory Committee (Stafford-Anfimov) ad- 
vises both agencies on the operational and safety status for each Soyuz flight. 

Q3. Since Crew Escape Systems, including emergency detection and launch abort 
systems, should be developed in conjunction with the launch vehicle, how could 
NASA evaluate the overall safety of an as-yet-to-be developed launch vehicle 
whether provided by a COTS provider. United Launch Alliance, or an inter- 
national partner"? 

A3. As suggested by the question, the evaluation of abort system effectiveness, and 
human rating in general, requires an integrated analysis of launch vehicle, crew 
capsule, crew, and the abort system itself. Any launch vehicle has to be designed 
to provide critical vehicle status and abort triggers to notify the crew vehicle and 
launch escape system that an abort is required or to allow the crew to make an 
abort decision. The design needs to take into account the launch vehicle failure 
modes and the timely detection of these failures. Transportation system developers 
would be required to design the integrated vehicle to support the abort trigger re- 
quirements. The crew escape system would have to be designed so that it can reli- 
ably and safely pull the crew capsule from the launch vehicle given the failures and 
resulting environments during the critical portions of the launch vehicle’s flight pro- 
file. An integrated safety analysis to review the specific implementation would be 
conducted to assure that effective crew escape capabilities are available to address 
critical failure scenarios of the integrated system. 
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NASA has spent considerable effort in doing this kind of analysis for the baseline 
architecture. Similar analyses will have to be performed for other concepts. 

Q4. From the Safety and Mission Assurance perspective, would you elaborate on the 
potential to close the gap using EELV’s, including cost information if available^ 

A4. NASA doesn’t human-rate individual components or elements of a launch sys- 
tem, so in order to use an EELV that EELV would need to be human-rated in com- 
bination with all of the flight and ground elements needed to accomplish a specific 
reference mission. The EELVs in combination with these other elements (spacecraft, 
abort/escape/egress system, etc.) would need to be human-rated to ensure that col- 
lectively they provide a sufficient level of safety, and particularly allow for surviv- 
ability of the crew during any potential hazardous situations. 

In 2009, NASA commissioned a study performed by Aerospace Corporation to 
study the feasibility of human rating current EELVs. The study concluded that 
EELVs are “human-ratable,” however the cost to do so is highly dependent on pro- 
gram requirements, specific interpretation of and compliance with NASA’s human- 
rating requirements document (NASA Procedural Requirements 8705.2) and espe- 
cially noteworthy the integration of the EELV design with other elements of the sys- 
tem. In addition, the study found that the gap between Shuttle retirement and 
availability of a new crew transportation system to ISS would not be reduced from 
the then-current Constellation target milestone of March 2015 initial operating ca- 
pability. 

Q5. Since a significant portion of launch failures are due to human error it is crit- 
ical to have a strong safety culture. The Columbia Accident Investigation Board 
reiterated again the importance of a strong safety culture. Would a shift to com- 
mercially provided low-Earth orbit launch vehicles disrupt that culture at 
NASA? Could that be cause for concern? 

A5. Depending on the acquisition approach, contracting with industry for a new ISS 
crew transportation system could represent some changes in NASA’s traditional 
human spaceflight processes, including its interactions with industry. NASA will 
“own” major NASA-related safety requirements (visiting vehicle and human rating), 
and will establish an appropriate forum for verification that the system has met 
them. To the extent that NASA retains accountability for the safety of its employees 
and contractors (crewmembers), it will play a role in technical oversight/insight, as 
well as hazard analysis, and risk assessment and acceptance. These processes and 
relationships, however, are only a part of a strong safety culture, the remaining as- 
pects being all about communications in all directions. Especially important will be 
the establishment and maintenance of a strong effective dissent and appeal system 
on both the commercial and government side of the relationship. NASA is com- 
mitted to preserving a strong safety culture regardless of the acquisition approach. 


Questions submitted by Representative Marcia L. Fudge 

Ql. In your prepared statement, you cite that NASA is beginning development of a 
more concise set of human rating technical requirements applicable to NASA de- 
veloped crew transportation systems as well as commercially -developed crew 
transportation systems or use by NASA. 

• When do you envision these more concise human rating technical requirements 
will he defined so that commercial stakeholders can understand NASA’s 
needs? 

• Is solely meeting these technical requirements the litmus test NASA should use 
to determine if a commercial transportation system is safe for its astronauts 
to use? 

Al. NASA has formed a team to develop an implementation plan for human rating 
of commercially-developed crew transportation systems. This plan is based on 
NASA’s approach to safety risk management and the existing Agency human rating 
philosophy. This plan will clarify NASA expectations including technical require- 
ments, and will be derived from: NASA Procedural Requirements 8705.2 (Human- 
Rating Requirements for Space Systems); Space Shuttle Program 50808 (ISS to 
Commercial Orbital Transportation Services Interface Requirements Document); 
and, other existing NASA requirements documents, such as NASA Directives, NASA 
Standards, NASA-adopted standards, the Exploration Architecture Requirements 
Document, the Constellation Architecture Requirements Document, and the Con- 
stellation Human Systems Integration Requirements. 

NASA released the preliminary plan using a NASA Request Eor Information on 
May 21, 2010. Responses were due on June 18, 2010 and NASA is in the process 
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of reviewing and evaluating the responses. NASA plans to finalize the Commercial 
Human-Rating implementation plan in time to support an open-competition when 
NASA pursues the development phase of commercial crew transportation systems. 

Meeting NASA Human-Rating requirements is an important part of the overall 
process, but not the sole test NASA will use to determine if a commercial transpor- 
tation system is safe for NASA astronaut transportation. Any system destined to op- 
erate in the proximity of the ISS will also be subject to the ISS “Visiting Vehicle” 
requirements, for example. 

NASA will define, as part of this plan, the appropriate level of ongoing govern- 
ment visibility into the development, testing/engineering analysis, production and 
operation of all launch vehicles and spacecraft that carry NASA astronauts. NASA 
will also define its role in hazard and risk analysis/acceptance, as well as design 
and operational certification and flight readiness. 

Q2. The Columbia Accident Investigation Board (CAIB) recommended the establish- 
ment of an independent Technical Engineering Authority responsible for tech- 
nical requirements and all waivers to them. In response, NASA created the 
NASA Engineering and Safety Center’s (NESC) which operationally falls under 
the responsibility of your office. How has that independent center enhanced the 
safety of human space flights 

A2. In response to recommendations from the CAIB, NASA formalized Technical 
Authority (TA) roles for NASA’s Safety and Mission Assurance, Engineering and 
Health and Medical organizations establishing clear authority and responsibilities 
related to the technical requirements established by the TA organizations and waiv- 
ers to those requirements. 

The TAs are a key part of NASA’s overall system of checks and balances and pro- 
vide independent oversight of programs and projects in support of safety and mis- 
sion success. Individuals fulfilling the TA roles are embedded in their respective 
technical cadres and organizations across the Agency, and are continuously engaged 
in programmatic decision-making processes. They ensure that all opinions are heard 
and engage with line management to ensure that the right technical decisions are 
made with respect to requirements, non-compliances, hazards, critical items, as well 
as ensuring work is performed to a high standard. 

The NESC was formed in response to CAIB criticism of the safety organization’s 
lack of technical depth. Its mission is to perform value-added independent testing, 
analysis, and assessments of NASA’s high-risk projects to help ensure safety and 
mission success. The organization has established a strong set of processes, tech- 
nical leaders and communities of practice across the Agency and access to key tech- 
nical experts and facilities outside of NASA to allow rapid response with the best 
possible technical capability to the Agency’s most critical problems. In a typical 
year, the NESC performs in excess of 50 independent assessments for a variety of 
customers, including, but not limited to, the Agency’s SMA organizations. 

The Technical Authorities and the NESC operate across all of NASA but are par- 
ticularly important in addressing problems which arise in connection with human 
space flight. The totality of the contributions is too great to catalog here, but two 
examples are illustrative. 

Between the time of STS-114, the return to flight after Columbia, and the final 
preparations for the launch of STS-120 in the fall of 2007, anomalies with the Rein- 
forced Carbon Carbon panels used on the wing leading edges had come to light. All 
panels show cracking and crazing after exposure to high temperatures with damage 
thresholds established for repair or replacement but there was new test data poten- 
tially indicating the need to repair or replace panels not previously suspect. 

The NESC was asked to quickly establish an independent team to assess the 
problem in parallel with the ongoing work being performed by the project team. The 
NESC team performed a great deal of high caliber and ground breaking technical 
work in a short time and recommended both a measurement methodology and quan- 
titative threshold. The processes established in support of the Technical Authority 
model for the flight readiness reviews and leading to the Certification of Flight 
Readiness ensured that the recommendations were fully considered and led to adop- 
tion of both the recommended flight worthiness criterion for the RCC and a longer 
term program to better understand the materials and utilize nondestructive inspec- 
tion techniques in support of improved flight safety. 

Data from the flight of STS-126 in November 2009 and post-flight inspection of 
the hydrogen flow control valves showed that a large piece of a valve poppet had 
liberated. This had never happened before in flight and raised significant safety of 
flight concerns for STS-119 since there were multiple scenarios leading to cata- 
strophic failures during powered flight. The problem was extremely difficult and the 
first round of reviews could not establish a rationale and supporting data to allow 
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a commitment to launch. In response, the Project team was augmented with engi- 
neering and safety and mission assurance personnel from across the Agency to es- 
tablish and execute a combination of tests and analyses to establish the basis for 
a safety of flight assessment. The NESC brought its cadre to bear, both to directly 
support the technical teams and also to provide independent assessments in critical 
areas. Technical authority line managers were strongly engaged both to ensure that 
all possible resources were brought to bear but also that the many alternate tech- 
nical opinions were appropriately heard and considered and that a flight rational 
could be established on a sound technical basis. As a result of an extraordinary 
quantity and quality of work done in a very short time, not only was a sound deci- 
sion basis established for the safe launch of STS-119 but the understanding of the 
flow control valve failure modes and effects and non-destructive examination tech- 
niques were greatly improved. This in turn led to greatly improved processes and 
criteria for all subsequent missions and significant reduction in risk. 

Q3. The Augustine Committee has done a eommendable job of providing options and 
alternatives for the U.S. Human Spaee Flight program for consideration. How- 
ever, changes to an ongoing development program carry the real threat of major 
adverse impacts on cost and schedule, increased risk and dislocations for the 
workforce. In this regard, please comment on the safety impacts of two potential 
changes discussed in the Summary Report: 1) Reducing Orion crew size; and, 
2) Relying on commercial crew-delivery service rather than continuing the devel- 
opment of Ares 1. 

A3. NASA looks at any significant change in architecture or performance require- 
ments with an eye toward safety impacts. The decision to reduce the crew size from 
six to four had no direct or indirect adverse safety. The primary rationale for the 
Orion crew size requirement change was to simplify design activities and thereby 
reduce cost and schedule challenges while improving mass margins during the Pro- 
gram’s early phases. Since the meiximum crew size requirements were originally es- 
tablished at the Constellation Systems Requirements Review in 2006, Orion had 
been pursuing parallel designs for the Space Station six-person and the Lunar four- 
person configurations. Therefore, Orion’s work included multiple designs for crew 
seat pallets and Environmental Control and Life Support hardware, and multiple 
analyses for consumables, stowage, and crew operations. By shifting to a common 
crew size configuration for the Space Station and lunar missions, Orion’s team 
would be able to focus activities on a single design and analysis set rather than two 
parallel design efforts. 

The maximum crew size reduction for Orion ISS missions actually had operational 
advantages that improve crew safety: 

• The free volume for the crew’s on-orbit activities and tasks could be increased 
by 20-25 cubic feet. 

• The nominal and emergency crew egress capability would be improved. 

• More stowage volume and mass could be made available for carrying mission 
equipment and bringing payloads and cargo to the ISS. 

The President’s budget “funds NASA to contract with industry to provide astro- 
naut transportation to ISS as soon as possible, reducing the risk of relying solely 
on foreign crew transports.” In response, NASA will use an acquisition approach ap- 
propriate to the criticality of and risk inherent in the mission. Included will be an 
acceptable mix of NASA technical requirements and industry practices as well as 
NASA technical insight and management oversight. These things, along with the 
design, support and demonstrated reliability of the transportation system, will allow 
NASA to determine when the system will be suitable to carry NASA (and Inter- 
national Partner) crews to the ISS. 

Q4. One of the Augustine Committee findings is that investment in a well-designed 
and adequately funded space technology program is critical to enable progress 
in exploration. NASA’s space technology budget has been severely reduced over 
time. Power, propulsion, in-space refueling, communications and a host of other 
technologies will be crucial for exploration. What safety -related considerations 
are associated with investing in such technologies? 

A4. Without new technologies, human exploration of the solar system will likely be 
unaffordable and unsustainable. The safety implications of new technologies, how- 
ever, must be evaluated on a case-by-case basis. While the use of new technologies 
can provide safety benefits, e.g., by eliminating risks in existing systems and 
through increasing safety margins, they also generally introduce risks due to imma- 
turity of and unfamiliarity with such technologies. 
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These impacts must be assessed as part of design and operational trade studies. 
For example, technology development for in-space refueling must weigh the safety 
impact of designs involving an initial crew transportation system that fully relies 
on in-space refueling against a crew transportation system that can take advantage 
of in-space refueling after the refueling technology has been proven with robotic 
missions. 

However, new technologies are not necessarily used to improve safety, and may 
instead be used to expand mission goals. For example, weight savings in one area 
might be used to increase science/mission payload or to increase propellant reserves 
or shielding. The investment in developing and integrating new technologies is es- 
sential to ensuring that our Nation’s space program is engaged in innovations that 
will help NASA find better and safer ways to explore the solar system. 


Questions submitted by Representative Dana Rohrabacher 

Ql. In the Launch Services Program NASA has generally required that a launcher 
demonstrate multiple successful flights before being considered for use launching 
science payloads and satellites. In some cases, up to 14 successful flights of the 
rocket were required before being used to launch a “Class A” satellite. By con- 
trast, the Constellation Program is currently planning (subject to review) only 
one full-up test flight before placing astronauts aboard the Orion! Ares I. I un- 
derstand that these two parts of NASA — manned and unmanned — have different 
requirements and operate with different rules, but in both cases the overall mis- 
sion success is a primary objective. Can you please explain how these two sys- 
tems of evaluating launch vehicles have evolved so differently, what are the simi- 
larities, and in the above example how NASA’s Constellation program can com- 
fortably accept a plan that demands 92 percent fewer test flights than what was 
required for a satellite program! 

Al. The most important factor in determining when it is appropriate to fly crew- 
members on a new test vehicle is the level of confidence the team has in safely con- 
ducting the test. In the case where NASA validates the technical requirements, de- 
signs and manufactures the flight and ground systems, writes the launch commit 
criteria and flight rules, performs all number of ground tests and engineering anal- 
yses, and conducts the reliability, safety and risk analyses, it has arguably maxi- 
mized its understanding of and associated confidence in the system. Based on this, 
the team decides when to conduct its first crewed flight test. As the distance be- 
tween NASA and the design, development, manufacturing, and operations increases, 
so does the Agency’s reliance on demonstrated reliability, and/or other government 
certifications (i.e. Russia’s ROSCOSMOS or the U.S.’s Federal Aviation Administra- 
tion). NASA has not come to a final determination on the number of test flights that 
would be required prior to sending NASA astronauts into space using the crew 
launch vehicle under the Program of Record. 

Regarding the comparison with the LSP, NASA has a range of options available 
depending on the launch system’s proven reliability, the value of the payload, and 
the certification status of the provider. In some cases, this program has little insight 
into, or oversight of, the commercial launch providers. In those cases, NASA re- 
quires a demonstration of 14 successful launches for certification of the launch vehi- 
cle for high value payloads. This certification option, which is rarely chosen, is 
predicated on an assumption of no prior knowledge about launch vehicle perform- 
ance, and limited government oversight into the design and operation. Another op- 
tion is to fly the NASA payload on a relatively new system with as few as three 
flights (two successes in a row), but with substantial NASA process requirements 
and insight into the contractor’s design, engineering and operations processes. For 
lower value payloads with a higher risk tolerance, another certification category is 
available. It only requires one successful flight of the launch vehicle and a signifi- 
cant technical assessment. 

NASA’s ongoing human spaceflight program has established a host of safety and 
mission assurance activities including (subsystem) tests, verifications, and analyses, 
which would establish a level of confidence in the vehicle’s performance prior to the 
full-system test launches. Decisions regarding the needed number of full-system test 
launches should account for these assurance activities. 

Q2. John Marshall from the Aerospace Safety Advisory Panel (ASAP) said in his 
written testimony that, “more than two years into the COTS program, efforts to 
develop human rating standards for a COTS-D like program have only just 
begun and no guidance thus far has been promulgated. If COTS entities are ever 
to provide the level of safety expected for NASA crews, it is imperative that 
NASA’s criteria for safety design of such systems immediately be agreed upon 
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and provided to current or future COTS providers.” What steps is NASA taking 
to address this concern and develop a process that can be used by potential 
COTS-D competitors? 

A2. NASA has determined that human rating requirements will apply to any crew 
transportation systems used by the Agency to provide transportation to low earth 
orbit. Consistent with the President’s plan to “contract with industry to provide as- 
tronaut transportation to the International Space Station as soon as possible, reduc- 
ing the risk of relying solely on foreign crew transports . . NASA is using Amer- 
ican Recovery Reinvestment Act (P.L. 111-6) funds to develop guidelines for acquisi- 
tion and oversight/insight approach in FY 2010. NASA’s approach to human-rating 
a transportation architecture for a specific mission starts with the initial design 
phase, and assumes all pertinent NASA standards and requirements are followed 
throughout the project. This task will define a minimum set of human rating re- 
quirements and consolidate them into a single product using a development team 
comprised of representatives from NASA’s human space flight programs, NASA 
technical authorities, and the NASA Astronaut Office. In addition, NASA will define 
hazard and risk assessment processes and goals and thresholds to support risk ac- 
ceptability decisions. NASA will seek the advice of interested industry stakeholders 
to refine the human rating technical requirements. 

More specifically, NASA has formed a team to develop an implementation plan 
for human rating of commercially-developed crew transportation systems. This plan 
is based on NASA’s approach to safety risk management and the existing Agency 
human rating philosophy. This plan will clarify NASA expectations, including tech- 
nical requirements, and was derived from: NASA Procedural Requirements 8705.2 
(Human-Rating Requirements for Space Systems); Space Shuttle Program 50808 
(ISS to Commercial Orbital Transportation Services Interface Requirements Docu- 
ment); and, other existing NASA requirements documents such as NASA Directives, 
NASA Standards, NASA adopted standards, the Exploration Architecture Require- 
ments Document, the Constellation Architecture Requirements Document, and the 
Constellation Human Systems Integration Requirements. 

NASA released the preliminary plan using a NASA Request For Information on 
May 21, 2010. Responses were due on June 18, 2010 and NASA is in the process 
of reviewing and evaluating the responses. NASA plans to finalize the Commercial 
Human-Rating implementation plan in time to support an open-competition when 
NASA pursues the development phase of commercial crew transportation systems. 

Q3. Dr. Fragola indicated during the hearing that a launch vehicle with a liquid 
core and solid strap-ons was likely to present a more dangerous, or a more dif- 
ficult environment for crew escape in the event of a launch catastrophe. What 
is the reason for this, and does it apply evenly to shuttle derived concepts such 
as shuttle-C, or Jupiter Direct type designs? Further, it has been reported that 
pursuant to the Augustine committee report, NASA is studying the human rat- 
ing of heavy lift vehicle concepts (or their derivatives) as potential Orion launch 
vehicles. Assuming any new Orion-earrying heavy lift vehiele would use a com- 
bination of liquid core with solid strap-ons, how does that affect the crew escape 
and Loss of Crew calculations? 

A3. The reason that strap-on boosters in general represent a more difficult environ- 
ment for crew escape in event of a launch catastrophe includes the following two 
factors. First, such configurations have failure modes that would more readily prop- 
agate from one booster to another, with the potential to lead to a more energetic 
post-accident environment. Secondly, there is a much greater potential for thrust 
imbalance, leading to greater aerodynamic stresses. These concerns apply to Shut- 
tle-derived concepts. 

A better understanding of the specifics and absolute values of the relative risks 
of the various configurations would require simulations of the post accident environ- 
ment and system responses similar to those already performed on the Ares I con- 
figuration. If Orion and the launch abort system remain the same, it would be ex- 
pected that in the heavy lift configuration the factors mentioned above would cause 
a higher risk to the crew than in the Ares I configuration. 

At the same time, compared to side-mount options, this configuration would cause 
the crew to be further removed from the first stage, which would actually reduce 
risk to the crew due to failures of the solid/liquid first stage combination. The in- 
creased launch capability of a heavy lift configuration would further allow for modi- 
fications to Orion and the launch abort system that enhance crew survival capabili- 
ties. 
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Answers to Post-Hearing Questions 

Responses by Mr. Jeff Hanley, Program Manager, Constellation Program, Explo- 
ration Systems Mission Directorate, National Aeronautics and Space Adminis- 
tration 


Questions submitted by Chairwoman Gabrielle Giffords 

Ql. What is the basis of NASA’s determination that the Ares I ! Orion combination 
should be ten times safer than the Shuttled How confident are you that you can 
achieve that level of safety? 

Al. With regard to your questions about the current program of record, NASA’s 
Constellation Program was developed with the goal of increasing astronaut safety 
tenfold relative to Shuttle missions based on two key directives: 

• The May 2004 Astronaut Office Position on Future Launch System Safety, 
which stated that office’s belief that an order of magnitude reduction of risk 
during the ascent phase of a crewed space mission was possible. This position 
was written with regard to the Orbital Space Plane booster selection, and in 
response to the Columbia Accident Investigation Report, and it serves as a 
goal for increasing system safety during this critical phase of flight. 

• The Exploration Systems Architecture Study (ESAS) of November 2005, 
which suggested that “. . . crew missions to the ISS may be at least 10 times 
safer than the Shuttle . . .” While risk estimates for various phases of flight 
(e.g., ascent, docking, re-entry, landing) and spacecraft components (e.g., serv- 
ice module) are constantly undergoing review the Constellation Program’s 
Loss-of-Crew (LOG) requirements were derived from the ESAS. 

Probabilistic Risk Analysis (PRA) is a tool used to analyze system risks and un- 
derstand a systems probability of problems and the magnitude of impacts due to the 
problems. Program managers use PRAs to assess designs in an effort to judge mer- 
its of technical trades. Additionally, NASA communicates risks to project, engineers 
and the outside world using PRAs. PRA numbers fluctuate over time as designs ma- 
ture and system trades are accepted. 

From the very beginning. Constellation has been committed to building an archi- 
tecture that effectively balances the use of critical design commodities to achieve the 
optimal safety and mission success capability. Therefore, at the time of my testi- 
mony, NASA believed its ultimate goal of increasing safety tenfold via the utiliza- 
tion of the Ares I/Orion combination, while seemingly daunting, would have been 
achievable. However, based on current data, NASA believes the Ares I/Orion com- 
bination overall would be about five times safer than the Shuttle. These numbers, 
however, are averaged estimates and not the way that NASA calculates or tracks 
the PRA of specific vehicles. 

In terms of Ares I/Orion, the current PRA for the integrated stack for the Ascent 
Phase shows a 1 in 1,877 probability LOG. It also greatly exceeds the challenging 
1 in 1,000 LOG Ascent Phase requirement. This is due to both the projected reli- 
ability of the Ares I launch vehicle and a robust Launch Abort System. For the On- 
Orbit Phase, the current Gonstellation Program PRA results in a 1 in 521 for a 210 
day mission. This phase is heavily dominated by the micrometeoroid and orbital de- 
bris risk to both vehicles. For the entry phase, as we have seen through history, 
is just as demanding as the ascent phase. Because of this, NASA has the same chal- 
lenging 1 in 1,000 LOG requirement as for the ascent phase. Unlike ascent where 
there will be abort capabilities; there is no easy way to gain significant improvement 
for the entry phase. The risk is dominated by parachute and thermal protection sys- 
tem contributions. These systems are currently a priority for design improvements 
as well as a comprehensive test program. 

In comparison, the purpose of the Shuttle PRA is to provide a useful risk manage- 
ment tool for the Space Shuttle Program to identify strengths and possible weak- 
nesses in the Shuttle design and operation. Gurrently, the mean PRA for an entire 
Space Shuttle mission to the ISS (including the ascent, on-orbit and re-entry 
phases) is 1 in 89, with a range of 1:63 to 1:130 (representing the 5th and 95th per- 
centiles). The equivalent PRA figure for Gonstellation is 1 in 406, representing a 4.6 
factor of improvement over the Shuttle risk assessment for the equivalent 5 day 
docked ISS mission. 

As with any PRA of a large, complex, and engineered system, the Shuttle PRA 
is developed for a defined scope, and reasonable engineering judgment is used to 
make assumptions where necessary. Therefore, limitations exist as to its use, and 
the per-mission ratio should not be seen as a single-point estimate, but merely the 
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mean number in a range of risk. The PRA can be useful in comparing different sys- 
tems (assuming they are calculated using similar bases), and not as an absolute risk 
number. For these and other reasons, it is difficult to compare Constellation risk 
estimates to the Shuttle PRA; NASA has a far higher level of knowledge about the 
Shuttle system and the PRA methodologies for operational systems are different 
from the risk estimation methodologies for systems in development. 

Q2. You are having to human-rate the Constellation launch vehicle and spacecraft 
system. How involved a process is that? Is it simple compliance with a set of 
itemized requirements, or is it something more involved? 

A2. Regarding human-rating, the launch of any spacecraft is a very dynamic event 
that requires a tremendous amount of energy to accelerate to orbital velocities in 
a matter of minutes. There also is significant inherent risk that exposes a flight 
crew to potential hazards. Through a very stringent human rating process, NASA 
attempts to eliminate hazards that could harm the crew, control the hazards that 
do remain, and provide for crew survival even in the presence of system failures. 

Human rating is a process that involves more than a simple set of design require- 
ments. The process intertwines with the acquisition process, starting with initial 
concept design and progressing through all phases of the program. Its progress is 
checked and reported to Agency management at each major acquisition milestone. 
It includes not just requirements compliance, but also consideration of hazards, fail- 
ure modes, escape system effectiveness and limitations, failure tolerance, and other 
safety risks both in flight and on the ground. The requirements are all applicable 
mandatory standards used in designing and operating our most important un- 
manned mission systems, with the addition of human crew unique requirements 
dealing with life support, human factors, crew escape/abort and survivability. The 
scope and magnitude of the process is dependent upon the Agency’s risk tolerance 
for the particular mission, as well as the complexities and hazards associated with 
the vehicle design and its assigned mission profile. As written, NASA’s human rat- 
ing process is structured specifically for NASA developed systems, where the NASA 
program manager is the design decision and risk acceptance authority, and the 
NASA Engineering, Safety and Mission Assurance, and Health and Medical Tech- 
nical Authorities have cognizance of the associated standards and requirements. 
However, Agency policy allows some or all of its human rating process and require- 
ments to be applied, as it sees fit, to systems developed by other organizations or 
entities as conditions for clearance to fly NASA or NASA sponsored crew/passengers. 

For NASA developed systems, human rating certification includes: validation by 
the technical authorities that the design requirements are properly tailored to the 
program; verification that the design meets those design requirements (by ground 
test, analysis, and flight test as appropriate); and full-up flight demonstration of an 
appropriate level of system reliability prior to manned flight test and prior to full 
mission clearance. Finally, NASA human rates an entire system, including ground 
elements and operational procedures (fundamentally, anything about the flight or 
ground system that impacts flight crew/passenger safety). This means that it looks 
at integrated safety issues and accident scenarios, not just failures at the subsystem 
level. 

Given that safety is NASA’s first core value, the Constellation Program, had in- 
corporated safety into the Constellation design process from the very beginning. In 
doing so, the Constellation program chose to tightly interweave the design and safe- 
ty team members into the decision process, including Engineering, Safety and Mis- 
sion Assurance and Health and Medical technical authorities, so that each have a 
role in the Agency’s human rating process. The team has actively worked with the 
design engineers to provide expertise and feedback via various assessments and 
analysis techniques throughout the design maturation process. 

Human rating a spaceflight system is not as easy as following one document. In- 
stead, it is an intricate, continuing process, involving the translation of specific mis- 
sion requirements into designs that can be built, tested, and certified for flight and 
an understanding of risks with mitigation approaches in place. Additionally, before 
any system can be human rated, it must meet all other Agency standards and re- 
quirements applicable to a specific mission and type of system. Therefore, part of 
the challenge to projects such as Ares I and Orion has been that there is currently 
no single document that spells out what they should do to receive a human rating 
certification from the Agency. In turn, this is partly why NASA is investing FY 2009 
Recovery Act funds to develop a more concise set of NASA human rating technical 
requirements. 

Although NASA does not yet have one consolidated document for human rating, 
the Constellation Program has depended heavily on NASA Procedural Requirement 
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8705. 2B, in designing its spaceflight vehicles. This document is based on three key 
tenets: 

1) Human-rating is the process of designing, evaluating, and ensuring 
that the total system can safely conduct the required human mis- 
sions. The mission will have certain mission objectives and system perform- 
ance requirements that must be met. The mission will also expose the crew 
to potential hazards that must be considered early in the design process. 
During the design process, a careful examination of the potential hazards 
and design features that prevent hazards — known as “hazard controls” — is 
undertaken. Hazard controls are features incorporated into the system dur- 
ing the design phase to prevent the occurrence of a hazard. These can take 
many forms such as incorporating redundant or backup systems and compo- 
nents, application of system margins to ensure function of the system even 
under the most extreme conditions, proper selection of technical standards 
for design and construction, and rigorous process controls from early mate- 
rial and component selection through final assembly and checkout oper- 
ations. Mission objectives and performance requirements may need to be re- 
evaluated to reduce the risk for human spaceflight missions. The balance be- 
tween system performance and crew safety would be weighed among Engi- 
neering, Safety and Mission Assurance, and Crew Health and Medical tech- 
nical authorities. The outcome of the design will be a balance between meixi- 
mizing mission objectives while minimizing risk to the flight crew. 

2) Human-rating includes the incorporation of design features and ea- 
pabilities that accommodate human interaetion with the system to 
enhance overall safety and mission suecess. This tenet includes all the 
aspects of flight crew performance necessary for the crew to successfully 
carry out their mission, without imposing undo risk to the flight crew. Crew 
situational awareness, crew commanding, cockpit display design and space- 
craft environmental factors all are critical factors that affect a crewmember’s 
performance. For example, proper layout of controls, adequate crew cabin 
temperature and humidity, and proper mission workload planning all factor 
into the crewmember’s ability to safety operate the system and increase the 
likelihood of mission success. The same rigor and balance in design trades 
utilized in tenet one is applied also in tenet two to arrive at the best working 
environment for the crew that maximizes the probability of mission success, 
while minimizing the risk to the flight crew. 

3) Human-rating includes the ineorporation of design features and ea- 
pabilities to enable safe recovery of the crew from hazardous situa- 
tions. Launch of a crew has significant inherent risks, so even with all the 
care that goes into system design and development, the system must be de- 
signed to accommodate failure. Sometimes failure can be dealt with by de- 
signing redundant systems that would allow mission continuation. In some 
cases, however, mission continuation is no longer possible and steps must be 
taken to safely return the crew — an event that is usually referred to as a 
mission abort. In the case of a launch failure, an abort could involve an 
emergency return of the crew. The Orion vehicle, for example, will have a 
launch abort system which could be used to pull the crew capsule away from 
the Ares I launch vehicle and allow the crew to immediately return to Earth 
should a catastrophic event occur. An abort also can be an operational deci- 
sion to stop the mission and return the crew if, for example a system has 
degraded to a point that mission continuation exposes the crew to an in- 
creased probability of a catastrophic hazard. 

The President’s FY 2011 budget request includes significant investments to spur 
the development of commercial crew and further cargo capabilities, building on the 
successful progress in the development of commercial cargo capabilities to-date. A 
key early step to enable commercial crew transport is establishing a concise set of 
NASA human rating technical requirements that would be applicable to NASA de- 
veloped crew transportation systems for Low Earth Orbit (LEO) as well as commer- 
cially-developed crew transportation systems for use by NASA. NASA is investing 
Recovery Act funds to begin development of these requirements. A NASA team has 
completed an initial set of commercial crew human rating requirements documents 
and commercial human systems interface requirements document and the docu- 
ments are currently in the preliminary review cycle. A Request for Information will 
be issued within the next few months to seek industry feedback on related human- 
rating documents. In addition to the human rating requirements, NASA is devel- 
oping an insight/oversight model that will contribute to the safe flight and safe re- 
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turn of NASA crew members on commercial space vehicles. NASA’s years of experi- 
ence and lessons learned with respect to human rating of space systems will help 
shape future systems to be developed in as safe a manner as possible. 

Questions submitted by Representative Pete Olson 

Ql. Although the Ares I-X test flight was not an exact replica of the Ares 1, it in- 
volved a significant effort by the launch team to modify the facilities and develop 
the launch processing requirements and procedures to perform a successful test 
flight. In addition, Ares I-X was instrumented with over 700 sensors relaying 
information about the flight. To what extent do test flights improve safety and 
reliability by reducing overall risk? If adequate funding were available would 
more test flights allow you to accelerate the development and achieve an earlier 
crewed flight to shorten the gap? 

Al. In general, a comprehensive flight test program is essential to understanding 
the integrated vehicle systems in the actual flight environment. Flight test provides 
engineers with the confidence in and understanding of the flight systems. Flight 
tests can and will reveal many of the “unknown unknowns” which remain hidden 
in analysis and subsystem (not integrated) testing, thus allowing engineers to solve 
problems before committing high-value payloads or crews to flight. Flight tests also 
enable engineers to better calibrate models so that they are more accurate in pre- 
dicting worst case loads on the vehicle, responses of the vehicle’s structure, and 
other parameters that ultimately affect final designs for safety,. Furthermore, flight 
tests enable retirement of risks that cannot be fully mitigated through ground test- 
ing only. Demonstrating factors such as vehicle controllability, abort effectiveness, 
and re-entry and landing performance under integrated real-world conditions must 
occur before crewed flight. Flight tests prove these and other critical systems are 
therefore essential to attaining an acceptable risk posture for crewed flight. 

Even flight tests of vehicles that are not identical to the final operational configu- 
ration still provide valuable data, though for obvious reasons, the closer the test ar- 
ticle can be to final configuration, the more useful the test results. For example, 
NASA’s Ares I-X test flight afforded NASA the opportunity to collect data that 
would be used to refine computational models and subscale test techniques that 
would be used by Ares I, thus allowing reduction of conservatism incorporated into 
initial models. Other test events, such as the recent firing of an Ares first stage de- 
velopment motor, designated and subsequent static test firings, also con- 

tribute to analytical model validation and refinement. Such tests provide additional 
real data to anchor anal 3 dical models used to predict vehicle physics, such as thrust 
oscillations, specific to Ares I. While additional test flights for the program of record 
could help achieve additional risk reduction, NASA will ensure that all future cargo 
and crew systems adequately test all flight systems prior to operational use. 

In terms of the Constellation Program, the addition of more test flights would not 
allow NASA to achieve an accelerated first crewed flight. Acceleration is not merely 
a funding matter; the potential for acceleration is also influenced by hardware de- 
velopment and system testing schedules, and NASA has reached the point where 
the development schedule for most systems could not be accelerated due to testing 
needs and limits on the ability to further accelerate procurements. The “long pole” 
in getting to human flight is completing the system qualification testing, and the 
associated procurements, fabrication, and assembly for the qualification vehicle and 
hardware. To be clear, flight testing is different than qualification testing. Qualifica- 
tion testing exercises hardware through the full range of conditions it might experi- 
ence (such as maximum and minimum operating temperatures). Flight tests, on the 
other hand, validate integrated real-world performance at a single set of conditions. 
Additional flight testing would not accelerate the Constellation Program’s develop- 
ment schedule asgiven the long pole lies with qualification testing. 

Q2. Moving NASA beyond low Earth orbit will require a heavy lift launch vehicle. 
Ares 1 is developing many of the components needed for the heavy lift vehicle 
such as 5 segment solids, and the J-2X engines. Please comment on the role Ares 
1 plays as a risk reduction program for the ultimate heavy lift launcher? 

A2. Although the President’s FY 2011 budget request does not include the Ares ve- 
hicles, the budget request includes three new robust research and development pro- 
grams that will enable a renewed and reinvigorated effort for future crewed mis- 
sions beyond LEO. One of the three programs is a Heavy Lift and Propulsion Tech- 
nology Program, for which $559M is requested in FY 2011 and a total of $3. IB, is 
requested over five years. This aggressive R&D program will focus on the develop- 
ment of new engines and propellants, advanced engine materials and combustion 
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processes that would increase our heavy-lift and other space propulsion capabilities 
and significantly lower operations costs, with the clear goal of taking us farther and 
faster into space. 

The specific risk reduction achieved by the Ares I work will depend on the archi- 
tecture chosen for a new heavy lift vehicle. However, the lessons learned from Ares 
I will serve to inform those decisions. With regard to the current program of record, 
NASA’s Constellation architecture was designed to have two lift vehicles — the Ares 
I Crew Launch Vehicle and the Ares V Cargo Launch Vehicle (heavy-lift vehicle). 
The Ares I launch vehicle enabled early design and test of critical elements and sub- 
systems that would be required by the later Ares V heavy-lift vehicle. Such common 
elements include the J-2X Upper Stage engine, solid rocket motor, avionics and 
software and other systems. 

The Ares I vehicle took Ares V needs into consideration during development of 
the J-2X engine. The J-2X was planned to function as the Ares V Earth Departure 
Stage engine with only minor modifications to the Ares I engine. These modifica- 
tions would be implemented via engine modification kits. Likewise, reductions were 
made to the Ares lA^ solid rocket motor risks such as motor and nozzle design, ma- 
terials selection and testing, recovery system (parachutes) testing and operations, 
and motor manufacturing. 

Lastly, designing the Ares I allowed NASA to make an important technology leap 
in the design process. By transitioning from a 2-D, paper-based vehicle design and 
verification process to a 3-D model-based design environment, NASA was able to 
gain valuable experience with a new design system that can reduce costs while also 
increasing system reliability. 

The Program is working to capture all of the knowledge learned from development 
efforts, including test flights. The Program has spent significant time recently focus- 
ing on its Preliminary Design Review (PDR) elements of which concluded in March. 
NASA believes that completing the Constellation PDR will support not only the 
close-out process for Constellation, but also will ensure that historical data from 
Constellation work is documented, preserved and made accessible to future design- 
ers of other next-generation U.S. human spaceflight systems. 


Questions submitted by Representative Dana Rohrabacher 

Ql. In the Launch Services Program NASA has generally required that a launcher 
demonstrate multiple successful flights before being considered for use launching 
science payloads and satellites. In some cases, up to 14 successful flights of the 
rocket were required before being used to launch a “Class A” satellite. By con- 
trast, the Constellation Program is currently planning (subject to review) only 
one full-up test flight before placing astronauts aboard the Orion! Ares I. I un- 
derstand that these two parts of NASA — manned and unmanned — have different 
requirements and operate with different rules, but in both cases the overall mis- 
sion success is a primary objective. Can you please explain how these two sys- 
tems of evaluating launch vehicles have evolved so differently, what are the simi- 
larities, and in the above example how NASA’s Constellation program can com- 
fortably accept a plan that demands 92 percent fewer test flights than what was 
required for a satellite program! 

Al. The most important factor in determining when it is appropriate to fly crew- 
members on a new test vehicle is the level of confidence the team has in safely con- 
ducting the test. In the case where NASA validates the technical requirements, de- 
signs and manufactures the flight and ground systems, writes the launch commit 
criteria and flight rules, performs all number of ground tests and engineering anal- 
yses, and conducts the reliability, safety and risk analyses, it has arguably maxi- 
mized its understanding of and associated confidence in the system. Based on this, 
the team decides when to conduct its first crewed flight test. As the distance be- 
tween NASA and the design, development, manufacturing, and operations increases, 
so does the Agency’s reliance on demonstrated reliability, and/or other government 
certifications (i.e. Russia’s ROSCOSMOS or the U.S.’s Federal Aviation Administra- 
tion). NASA has not come to a final determination on the number of test flights that 
would be required prior to sending NASA astronauts into space using the crew 
launch vehicle under the Program of Record. 

Regarding the comparison with the LSP, NASA has a range of options available 
depending on the launch system’s proven reliability, the value of the payload, and 
the certification status of the provider. In some cases, this program has little insight 
into, or oversight of, the commercial launch providers. In those cases, NASA re- 
quires a demonstration of 14 successful launches for certification of the launch vehi- 
cle for high value payloads. This certification option, which is rarely chosen, is 



121 


predicated on an assumption of no prior knowledge about launch vehicle perform- 
ance, and limited government oversight into the design and operation. Another op- 
tion is to fly the NASA payload on a relatively new system with as few as three 
flights (two successes in a row), but with substantial NASA process requirements 
and insight into the contractor’s design, engineering and operations processes. For 
lower value payloads with a higher risk tolerance, another certification category is 
available. It only requires one successful flight of the launch vehicle and a signifi- 
cant technical assessment. 

NASA’s ongoing human spaceflight program has established a host of safety and 
mission assurance activities including (subsystem) tests, verifications, and analyses, 
which would establish a level of confidence in the vehicle’s performance prior to the 
full-system test launches. Decisions regarding the needed number of full-system test 
launches should account for these assurance activities. 
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Answers to Post-Hearing Questions 

Responses by Mr. John C. Marshall, Council Member, Aerospace Safety Advisory 
Panel, National Aeronautics and Space Administration 

Questions submitted by Chairwoman Gabrielle Giffords 

Ql. As you know, the Augustine Committee projected that commercial crew transpor- 
tation could be available by 2016. It does not appear that this projection re- 
flected the time needed for all of the milestones that must be met prior to the 
point at which NASA would be able to use such services to fly its astronauts 
to the ISS such as the time needed to get Congressional authorization and ap- 
propriation of funds; agreement on human-rating and other safety standards 
and means for verifying compliance; development of a regime for certification; 
and contract competition, negotiation and award of contract (S), and potential 
protest(s) by losing bidders. These are no small tasks, and it is not obvious that 
any of them could be skipped if the government is to make use of those services. 

a. In your opinion, what are currently the largest technical challenges or hurdles 
that potential commercial crew transportation providers are facing that might 
cause delays to their projected initial operating dates? 

Al, la. The milestones that you mention are all important. The process for enabling 
the current commercial cargo providers to provide crew transportation has not yet 
been initiated to any significant extent. Although there has been considerable dis- 
cussion about this topic by some manufacturers’ leaders, and most recently by the 
Augustine Committee, the “COTS-D” portion in the current agreements still re- 
mains a potential add on to the commercial cargo delivery demonstration projects. 
Thus, the “projected initial operating dates” that might be achieved with the current 
designs are unclear. This said, the two NASA contractors currently in the program 
have stated that their designs could be adapted to human transport. However, they 
have made these statements without having the detailed requirements for the nec- 
essary safety certifications. This is because NASA has neither developed those re- 
quirements nor provided them to the contractors. 

Clearly, the single most important technical challenge to commercial crew trans- 
portation that remains is developing the standards by which the suitability for 
human transport will be judged. Likewise, the process and authority for validating 
that those standards have been met — initially in the capability of the design and 
then through the construction and maintenance of the vehicle for its entire life 
cycle — also must be developed. Without firm performance criteria and the definition 
of the certification process for these criteria, the contractors’ abilities to meet any 
initial operating dates for the current designs remains speculative. 

Key hurdles to achieving certifiable crew transportation capability include: 

1. Clear technical criteria for the vehicle’s design performance and capability 
must be established and provided to all entities wishing to vie for providing 
the service. 

2. The process for overseeing the design’s development and validation must be 
created. 

3. The technical details for the necessary data submissions, design reviews, 
analysis, testing, and validation of results must be established and instituted 
via contract with the manufacturers. 

4. The process and authority for overseeing that the necessary safety is main- 
tained through proper maintenance and support throughout the vehicle’s life 
cycle must be developed, approved, and instituted. 

b. How confident can the Congress be that a commercial crew capability can be 
operational in 2016 while still having to carry out all of the activities that 
need to be completed before the first NASA astronaut can safely ride on an 
operational vehicle to the International Space Station? 

Al, lb. NASA recently has begun to develop definitive standards for assessing de- 
sign capability for crew transport. The criteria for safely docking vehicles with the 
ISS is already published and has been provided to the current commercial cargo 
contractors; however, it must be clear that this is only for protection of the ISS and 
does not provide any safety considerations for either humans or cargo inside the ve- 
hicle. If things move steadily and the Agency receives funding to contract for nec- 
essary activities, six years seems an adequate period to accomplish this objective. 
However, any effort to assess the feasibility of the 2016 operational start date for 
current designs would be premature since assessments of the current design devel- 
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opments against the criteria have not taken place. This is principally because the 
criteria necessary for that assessment are not yet fully determined. As a reference 
point, it took 10 years from program initiation to first flight for the space shuttle, 
and 10 years to reach the Moon with Apollo. Therefore six years duration, since we 
are building on the foundation of the existing cargo programs, seems like a reason- 
able time period. 

However, there are many variables that can have a profound effect on the dura- 
tion, three of which are particularly noteworthy. First, these vehicles and their 
launch systems have to demonstrate that they are capable of reaching LEO and 
safely delivering cargo to ISS. Obviously, success in this endeavor would be a large 
risk mitigator for extending the use of these vehicles to human transport. Second, 
the current designs have to be assessed against the previously described criteria, 
which will in no doubt drive needed design changes or additions. These modifica- 
tions must be within the vehicle’s design concept, i.e., technically feasible to incor- 
porate into the design without causing the approach to be altered fundamentally. 
Third, these changes will have to be described in contractual documents and placed 
in an RFP. That RFP will result in a priced proposal that must be negotiated and 
funded. It has to be presumed that the funding needed to incorporate these changes/ 
modifications/certifications will be provided. 

Q2. You make it clear in your prepared statement that the ASAP Panel recommends 
that NASA be “hands-on” in its approach. Why do you think NASA needs to be 
“hands-on” in its involvement^ 

A2. Without direct involvement in planning, design, testing, and validating the de- 
sign, NASA cannot state with assurance that the necessary safety level has been 
achieved. NASA must stay engaged in the entire process to ensure the level of safe- 
ty is achieved. 

Q3. “In your written testimony, you state that it is the ASAP position that “NASA 
is best qualified to be the oversight body for each of these actions (demonstra- 
tion, verification, and certification prior to NASA’s use for crew transport) as 
today only NASA has the eompetenee in hand to effectively audit the complex 
technical work required.” Can you elaborate on why the ASAP believes that?” 

A3. While NASA currently has no explicit safety requirements for crewed COTS 
systems and will have to tailor the existing processes significantly, it is the only 
agency in the US Government that has a knowledge base for the complex tasks nec- 
essary to determine whether a given space vehicle is safe enough to carry US astro- 
nauts. This knowledge base includes the myriad technical standards that hard won 
experience has shown to be essential to ensure inherent safety for the hardware. 
It also includes the test and evaluation capabilities and human rating process capa- 
bilities (noted previously) that validate proposed designs as safe for these astro- 
nauts. Please note that mission safety approval for NASA crew member transport 
to LEO, ISS docking and return is not the same as safety approval for private 
launches, for which the FAA is, and should remain, responsible. 

Q4. In the ASAP’s 2008 Annual Report, the panel notes that “NASA has an impor- 
tant one-time opportunity to better interweave safety as a eonsistent and more 
powerful operating parameter by hardwiring safety into the fabric and proce- 
dures of the new flagship exploration program. Constellation.” 

How would NASA infuse a similar strong safety culture into the agency if NASA 
were to purchase crew services from a commercial provider in lieu of developing 
the Constellation launeh system? 

A4. In our 2008 Annual Report regarding Constellation safety opportunities, the 
ASAP wrote: NASA should institutionalize safety programs, systems, processes, and 
reporting procedures including: 

• Robust, well-publicized safety programs that mirror industry best practices, 
including using current world-class systems and incentives as models 

• A safety management system that tracks accidents, mishaps, close calls, audit 
results, lessons learned, and data trends for these and other leading indica- 
tors 

• Consistent methodologies to identify hazards and to manage, articulate, and 
reduce risks 

• Defined, timely process for investigating, analyzing, and reporting on acci- 
dents 

• More rapid and thorough determination of root causes 

• Standardized accident report format, timeline, database, and metrics 
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• Timely, possibly Web-based distribution of lessons learned to prevent mishap 
recurrences 

Most of this still applies with little or no modification. However, the structure 
NASA will use to gain the insight and / or oversight to implement a safety program 
for commercial providers remains to be determined. Certainly, the U.S. Department 
of Defense (DoD) and the aerospace industry have learned how to work together to 
benefit safety when DoD engages in contracts with private industry for both weapon 
systems and critical services. Perhaps the DoD approach offers a good model. 

In the ASAP’s opinion, a sufficient safety program cannot be established in a 
“hands-off contractual relationship. 


Questions submitted by Representative Pete Olson 

Ql. Since a significant portion of launch failures are due to human error it is crit- 
ical to have a strong safety culture. The Columbia Accident Investigation Board 
reiterated again the importance of a strong safety culture. Would a shift to com- 
mercially provided low-Earth orbit launch vehicles disrupt that culture at 
NASA? Could that be cause for concern? 

Al. The ASAP believes that a good safety culture is advisable for any organization, 
regardless of its work, and ideally is present due to ethical leadership, good systems, 
and the correct “tone at the top.” The ASAP continues to assess NASA’s safety cul- 
ture, and while progress has been made since the CAIB report, our reports contain 
additional recommendations relative to safety culture. It is difficult and rare for an 
organization to achieve a “perfect” safety culture, and it is even more difficult to 
maintain one over time. 

In this regard, NASA will need to ensure that any organization that may provide 
a crewed vehicle in the future actually will value a strong safety culture. Role mod- 
eling and ensuring a strong safety culture among NASA’s contractors and potential 
partners will remain a difficult, yet doable, leadership task. Establishing a good 
safety culture in one’s own organization is hard work. Fostering it within another 
organization, where one does not have complete control, is even more difficult. 
NASA has experience working with many contractors and has been vigilant in es- 
tablishing good safety partnerships with them. It is the Panel’s expectation that the 
current emphasis on contractor safety would continue if firms were contracted for 
Low Earth Orbit (LEO) launches, and that NASA would continue to work to im- 
prove its own safety culture and the safety culture of those firms. 


Questions submitted by Representative Dana Rohrabacher 

Ql. What does the Aerospace Safety Advisory Panel believe are the most important 
steps to enable NASA to seriously consider, evaluate, and possibly implement a 
commercial crew competition? 

Al. On numerous occasions, the ASAP has addressed the urgent need for estab- 
lishing the human rating requirements, airworthiness criteria, and certification re- 
quirements for a possible commercially developed vehicle that may be used to trans- 
port NASA crew. It is essential that these requirements be considered and, as ap- 
propriate, incorporated into the on-going design phase as early as possible. However, 
the scope of this question extends beyond the preparedness activities that are need- 
ed to ensure that an acceptable level of safety is achieved. To a large extent, it is 
equally important to ensure that the program’s budgeting and planning process is 
initiated quickly. With this in mind, the ASAP notes the following serious chal- 
lenges that will need to be met to successfully implement a commercial crew com- 
petition and offers the following observations: 

A. NASA has not yet committed to developing a commercial crew transpor- 
tation capability. If NASA elects to proceed in that direction, a strong mes- 
sage needs to be communicated publicly that commercial crew transportation 
is a priority NASA mission and the mission’s requirements and objectives 
must be clearly stated. NASA should take steps to ensure that the impend- 
ing Administration’s decision for Exploration (based on the review of the 
Augustine’s human spaceflight study) re-affirms the need for NASA to assist 
in developing a commercial crew transport capability. 

B. It is not yet known which organization within NASA would assume responsi- 
bility for developing and implementing this program. Therefore, NASA will 
need to identify the Program Manager and provide adequate resources to ad- 
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dress the performance, technical, schedule, and cost requirements and anal- 
yses in formulating the overall program plan. 

C. NASA has not developed a program, acquisition strategy, budget, or initiated 
the legislative process necessary to obtain authorization for a COTS-D vehi- 
cle. Currently, NASA only has an option to exercise a COTS-D (crew trans- 
port) program under the Commercial Cargo and Crew Transportation Pro- 
gram. Space X currently has an unfunded Space Act Agreement option to 
demonstrate a COTS-D program. While NASA may also conduct a new com- 
petition for one or more crew demonstration partners, plans for imple- 
menting these options cannot go forward without authorized funding. 

D. NASA needs to determine to what extent and how it will be involved in the 
commercial providers’ processes and activities for defining the appropriate 
oversight and insight to ensure astronaut safety so that potential commer- 
cial partners can be informed. 

E. NASA needs to determine to what extent it may provide enabling tech- 
nologies and capabilities, including actual hardware or designs (such as that 
for the Orion), so that potential commercial partners can be informed. 

Q2. During the Q&A period, you mentioned that the ASAP had visited with Orbital 
Sciences regarding their COTS development program, and stated that they did 
not see any existing commercial market for cargo (and potentially crew) delivery 
to ISS. Did you ask the same questions(s) of SpaceX, and what was their re- 
sponse? 

A2. The original question by Chairwoman Giffords was “. . . do our witnesses be- 
lieve that would-be commercial crew transport service providers be able to garner 
sufficient revenues from non-NASA passenger transport services to remain viable 
over this time period as well?” My response to this question where I noted that we 
asked Orbital Science if they had done a market analysis to find other revenue 
sources was directly to the issue of crew transport services, not commercial cargo 
markets. This said, SpaceX management was not asked this question. Neither did 
they indicate whether alternative markets have been identified for their vehicle. 



126 


Answers to Post-Hearing Questions 

Responses by Mr. Bretton Alexander, President, Commercial Spaceflight Federation 

Questions submitted by Chairwoman Gabrielle Giffords 

Ql. What is the industry’s understanding of NASA’s human-rating and safety re- 
quirements, both technical and operational Is there an expectation by the indus- 
try that finalized requirements will be developed in conjunction with NASA? 

Al. The Aerospace Safety Advisory Panel correctly points out that NASA has not 
yet developed standards and processes for human-rating commercial vehicles. Until 
such time as commercial human-rating standards are determined, industry con- 
tinues to develop vehicle hardware based on the only standards available: those 
NASA established for its own vehicles, known as NPR (NASA Procedural Require- 
ment) 8705. 2B, effective May 06, 2008. 

Early dialogue between NASA and the commercial spaceflight sector on the na- 
ture of human-rating requirements for commercial systems is crucial, with dem- 
onstrated reliability, robust test flights, and a reliable crew escape system being 
key. To work with NASA and the FAA, US. industry has established a Commercial 
Orbital Human Spaceflight Safety Working Group, under the leadership of the Com- 
mercial Spaceflight Federation. The goal of the effort is to develop industry con- 
sensus on principles for safety of commercial orbital human spaceflight. Consensus 
has been reached among a number of companies on fundamental principles that will 
form the basis for our engagement with the FAA and NASA, but much more work 
remains to be done. 

Q2. During the hearing, Mr. Marshall said that some entities might not agree to a 
“hands-on” NASA role. Have federation members discussed what activities and 
level of scrutiny by a federal entity would amount to a “hands-on” relationship 
with which they could not agree? Can you provide examples of the types of ac- 
tivities and level of scrutiny that would create an unacceptable “hands-on” rela- 
tionship? What level of NASA involvement would be acceptable? 

A2. The commercial spaceflight industry believes strongly in the importance of a 
close relationship with NASA. The level of oversight and insight shared between 
NASA and FAA is a critical topic that is being addressed by, among other bodies, 
the Commercial Orbital Human Spaceflight Safety Working Group. Since NASA, 
FAA, and commercial spaceflight providers are just beginning their dialogue, it is 
not yet possible to state whether any specific requirement will be a subject of dia- 
logue or discussion between the stakeholders. 

As NASA Administrator Charles Bolden stated February 1: “Now, as 50 years ago 
when we upgraded existing rockets for the Gemini program, NASA will set stand- 
ards and processes to ensure that these commercially built and operated crew vehi- 
cles are safe. No one cares about safety more than I. I flew on the space shuttle 
four times. I lost friends in the two space shuttle tragedies. So I give you my word 
these vehicles will be safe.” The commercial spaceflight industry will work closely 
with Administrator Bolden and others to make sure that this objective is realized. 

Q3. Your prepared statement does not directly address how experience in reentry and 
landing will be obtained by potential commercial providers. By what means and 
in what timeframe will the commercial space transportation industry secure 
such experience? 

A3. Reentry and landing is a critical portion of human spaceflight that is essential 
to safety. It is our expectation that commercial providers will not place astronauts 
on an untested capsule, but rather these systems will have gained flight experience 
with reentry and landing before commencing manned flights with NASA astronauts 
aboard. In addition to full orbital flight tests, commercial providers may also con- 
duct suborbital tests, either as part of a subscale test launch or as a test of the 
launch abort system, which will therefore provide additional experience with the re- 
entry and landing phases of the mission profile. As no provider agreements for a 
full Commercial Crew program have yet been signed, the exact timeframe is yet to 
be determined on a per-company basis. Further, US. aerospace companies have been 
a part of every US. human spaceflight since the program began and have substan- 
tial technical expertise in reentry and landing systems and environments. 

Q4. In your prepared statement, you state that in addition to FAA’s existing regu- 
latory authority as codified in U.S. law, industry will satisfy customer-specific 
requirements levied by NASA in partnership with industry. With regards to your 
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reference to existing FAA authority, are you proposing that NASA astronauts fly 
under “informed consent”, which is the existing regulatory frameworki 

A4. The Federal Aviation Authority’s Office of Commercial Space Transportation 
currently levies different requirements for different categories of individuals, which 
include “crew” and “space flight participants.” The exact nature of the regulatory 
framework that would apply to NASA astronauts will require dialogue between 
NASA, the FAA, and the commercial space industry. Through the Commercial Or- 
bital Human Spaceflight Safety Working Group, industry stands ready to engage in 
this dialogue and determine the best path forward. However, it is vitally important 
for the viability of future commercial human spaceflight providers that launches be 
conducted under the same legal and regulatory framework, regardless of whether 
the customer is the U.S. government or a private entity. 


Questions submitted by Representative Marcia L. Fudge 

Ql. The discussion of safety requirements for crew and passengers on commercial 
transportation systems has, up to now, primarily focused on suborbital flights. 
Has the commercial space transportation industry identified any additional 
safety-related R&D requirements to enable future orbital flights by commercial 
crewed transportation systems'? 

Al. As compared to suborbital flights, orbital flights have more demanding engi- 
neering requirements in specific areas, such as: higher heat loads on re-entry, more 
powerful and longer engine firings, additional risk due to micrometeroid impact, 
more involved communications downlink to Earth, additional attitude control re- 
quirements, more complex abort scenarios, etc. Since the commercial crew program 
could be seen as commercializing accomplishments similar to those of the 1960s 
Gemini program, none of these problems require new technology to solve, but they 
would all benefit from additional R&D to improve capability, reduce risk, and re- 
duce costs. 

Q2. Are there any R&D efforts currently underway at NASA’s Glenn Research Center 
that would have applicability to potential commercial human space transpor- 
tation systems? Does the commercial space transportation industry have sugges- 
tions on how NASA’s Center R&D programs could contribute to enhancing the 
safety of potential commercial human space transportation systems? 

A2. Yes, there are multiple R&D efforts currently underway at Glenn Research 
Center that would be useful for commercial human space transportation providers. 
Facilities such as the Plum Brook Station (PBS), which has significant capability 
for full-scale upper-stage engine testing under simulated high-altitude conditions, 
would be useful to commercial providers. Plum Brook has the Space Power Facility 
as well as a hypersonic wind tunnel and cryogenic test facilities. Research in the 
fields of combustion, reacting flow systems, fluids, and materials testing of struc- 
tures for atmospheric and vacuum/space environments are some of the areas of in- 
terest to the industry. Other R&D efforts underway at Glenn’s Zero Gravity Drop 
Tower and the Spacecraft Propulsion Research Facility will also help enable future 
innovation for commercial space launch providers. Some ways in which NASA’s Cen- 
ter R&D programs could contribute to commercial spaceflight safety is through easi- 
er access to government test facilities, as well as enhanced interchange of technical 
information from NASA. 

Q3. If NASA were to use commercial transportation systems to fly its astronauts to 
the International Space Station, would the commercial space transportation in- 
dustry envision these astronauts being passengers or crew members? What sort 
of training would the industry envision as needed for these astronaut pas- 
sengers? if spacecraft are piloted by provider crew members, how would their 
training differ from that received by NASA’s astronaut passengers? 

A3. The exact regulatory framework that would apply to NASA astronauts will re- 
quire dialogue between NASA, the FAA, and the commercial space industry. 
Through the Commercial Orbital Human Spaceflight Safety Working Group, indus- 
try stands ready to engage in this dialogue and determine the best path forward 
for the FAA, NASA, and commercial industry. 


Questions submitted by Representative Pete Olson 

Ql. In preparation for commercial attempts to deliver cargo to the International 
Space Station, the COTS providers have been working closely with NASA to 
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evaluate whether they can comply with NASA’s Visiting Vehicle requirements 
that govern proximity operations around the ISS. Is there anything preventing 
NASA from working with potential commercial providers, whether COTS com- 
panies or United Launch Alliance, to establish the safety requirements processes 
and identify the modifications that would be required for those vehicles to meet 
NASA’s human-rating requirements^ 

Al. We do not believe at this time that there are any obstacles to cooperation be- 
tween NASA and commercial companies in the development of safety requirements 
processes and identification of needed modifications to vehicles. The Aerospace Safe- 
ty Advisory Panel recently stated that NASA should “accelerate the level of effort 
underway” to develop these commercial requirements. The commercial spaceflight 
industry is ready to work with NASA on these critical issues, and in fact has al- 
ready begun engaging with NASA through the Commercial Orbital Human 
Spaceflight Safety Working Group. While the Commercial Spaceflight Federation 
has taken the lead in organizing the effort, the working group includes representa- 
tives from a broader spectrum of companies, including several of the major aero- 
space primes and more traditional government space contractors. The goal of the ef- 
fort is to develop industry consensus on principles for safety of commercial orbital 
human spaceflight. So far, we have met among industry and have begun to engage 
NASA and the FAA. 

Q2. Recently there seems to be a great deal of interest among the potential commer- 
cial space providers to enlist the government as the primary buyer of space sys- 
tems. Presumably, this is because the government is currently the only known 
market for these services, although the industry is hopeful that non-govern- 
mental buyers will emerge. If no outside commercial market materializes, as was 
the case with early claims that a backlog of commercial satellites would help to 
reduce the cost of the development and operations of EELVs, wouldn’t the gov- 
ernments’ costs ultimately be higher since it would eventually have to pay for 
all the development and operational costs? 

A2. The Augustine Committee stated the following findings in its final report: 

“During its fact-finding process, the Committee received proprietary information 
from five different companies interested in the provision of commercial crew 
transportation services to low-Earth orbit. These included large and small com- 
panies, some of which have previously developed crew systems for NASA. The 
Committee also received input from prospective customers stating that there is 
a market for commercial crew transportation to low-Earth orbit for non-NASA 
purposes if the price is low enough and safety robust enough, and from prospec- 
tive providers stating that it is technically possible to provide a commercially 
viable price on a marginal cost basis, given a developed system. 

None of the input suggested that at the price obtainable for a capsule-plus ex- 
pendable-launch vehicle system, the market was sufficient to provide a return 
on the investment of the initial capsule development. In other words, if a cap- 
sule is developed that meets commercial needs, there will be customers to share 
operating costs with NASA, but unless NASA creates significant incentives for 
the development of the capsule, the service is unlikely to be developed on a 
purely commercial basis.” 

That is, the Augustine Committee found that non-NASA customers for commercial 
crew services did exist, but not in sufficient quantity for the business cases of pri- 
vate companies to close if they had to fund the development entirely on their own. 
On the other hand, if private industry and NASA share the development costs, then 
all parties will benefit. In particular, one additional market has been proven on a 
small scale, which is private citizens paying to travel to space. Over $150 million 
has been already paid by seven private citizens to travel on a Russia Soyuz to the 
International Space Station, at a steady rate of about one mission a year. In fact, 
the demand for this service has continued to increase despite an almost doubling 
of price from under $20 million per seat to now over $35 million per seat. Further- 
more, when Commercial Crew taxi services begin in the United States, demand will 
rise because would-be travelers, who are often business leaders running companies, 
will no longer have to spend six months training in Russia with limited contact with 
the outside world. Since American services will not require overseas training of that 
duration, will not require learning the Russian language, and will likely undercut 
the Russians in per-seat cost, the market is likely to increase for private space trav- 
elers. 

Other, not yet proven, markets for additional flights of the capsules include: (a) 
sovereign clients, in which other countries purchase seats on American vehicles 



129 


rather than the Russian Soyuz, and (b) industrial clients: since as Commercial Crew 
reduces the cost and increases the frequency of access to space, there could be in- 
creased interest in on-orbit industrial applications. 

When considering the potential of other markets, it is important to note that all 
Commercial Crew providers will use launch vehicles that already exist, such as the 
Atlas V, or in the late stages of development, such as the Taurus II and Falcon 9, 
and all of these vehicles will launch satellites and cargo before putting astronauts 
on board. Accordingly, it is already the case that a proven commercial market exists 
for at least the launch vehicle portion of each rocket-and-capsule system. Spreading 
the costs of a commercial system between the cargo, satellite, and crew markets will 
reduce the burden for each customer (NASA, DoD, and commercial customers). 

Q3. Given that the emerging commercial providers appear to believe strongly in an 
evolutionary approach to design and safety innovation to be achieved through 
flight experience gained from revenue flights undertaken without any prior safe- 
ty certification regime, wouldn’t premature reliance on the government as the 
dominate or only customer inhibit the ability of the emerging commercial pro- 
viders to sustain the innovation they believe is essential to their long-term com- 
mercial success^ 

A3. As the Augustine Committee stated the following findings in its final report: 
“unless NASA creates significant incentives for the development of the capsule, the 
service is unlikely to be developed on a purely commercial basis.” With NASA as 
a significant early customer, commercial industry will still be able to more rapidly 
incorporate innovations and technology upgrades than under a government program 
designed to for a 20-to-30 year operating lifetime. 

Q4. What do potential commercial crew transportation services providers consider to 
be an acceptable safety standard to conform to if their space transportation sys- 
tems were to be chosen by NASA to carry its astronauts to low Earth orbit and 
the ISS? Would the same safety standard be used for non-NASA commercial 
human transportation missions? 

A4. Safety is paramount for the commercial spaceflight providers. Indeed, commer- 
cial vehicles such as Atlas V and Delta IV, developed with substantial private fund- 
ing and engineering expertise, are already trusted to launch key government na- 
tional security assets upon which the lives of our troops overseas depend. Since 
probabilistic risk assessment calculations account for part failure, and do not ac- 
count for most of the root causes of accidents historically, such as human error or 
design flaws, and since even reliable vehicles have historically suffered a period of 
“infant mortality,” the commercial spaceflight industry believes that they will in fact 
achieve higher safety than that of government systems that intend to put human 
beings aboard on early orbital flights of the system. Commercial industry believes 
safety must include the following: 

• Demonstrated reliability through multiple orbital unmanned flights of the full 
system 

• Not placing crews on initial flights, since early flights are historically most 
risky 

• A highly reliable crew escape system 

• Standards-driven design and operations 

Industry believes that the safety of commercial spaceflight must be si^ificantly 
greater than that of the space shuttle in order to be successful. In addition to the 
FAA’s existing regulatory authority, as codified in U.S. law, industry will satisfy 
customer-specific requirements levied by NASA in partnership with industry. This 
process has already begun with the cooperation of the stakeholders involved. NASA 
and FAA will be there every step of the way, and will have oversight during design, 
testing, manufacturing, and operations. 
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Answers to Post-Hearing Questions 
Responses by Dr. Joseph Fragola, Vice President, Valador, Inc. 

Questions submitted by Chairwoman Gabrielle Giffords 

Ql. The Augustine Committee’s report cited five basic questions that could for the 
basis of a plan for the U.S. space flight program, but “how could crew safety 
be dramatically improved” was not one of them. Should it have been? And if 
so how would it have informed their deliberations? 

Al. It is my opinion that the question of how could crew safety he dramatically im- 
proved should have not only been one of the five basic questions for the basis of 
a plan of the U. S. space flight program, but that it should have been the primary 
question. In fact it is difficult for me to understand how a committee could, on the 
one hand state that crew safety was the sine qua non of their work, and yet not 
include crew safety as a primary question. I believe if they had included it as a pri- 
mary question they would have understood better how deliberately during ESAS, 
and subsequent to ESAS in the development of the Ares I vehicle design the thrust 
of all decision making was toward the development of a dramatically safer crew 
launcher than heritage systems such as the Space Shuttle or commercially available 
systems, such as Atlas or Delta. 

Q2. Reliability and safety seem to be used interchangeably by some when discussing 
crew safety. Are they really the same thing, and if not what is the distinction? 
How important a distinction is it? 

A2. There is a lot of confusion in the meaning of the term safety. The definition 
varies and to some, particularly those in the systems safety community, safety in- 
cludes any significant loss. Those in the risk assessment community include only 
losses of life. However neither community would accept the fact that the terms reli- 
ability and safety are interchangeable when it comes to loss of life. The important 
issue to recall as it relates to launch vehicles is that reliability is indistinguishable 
from safety for unmanned spacecraft payloads, but the two are crucially different 
for manned space vehicles. This is because of the important distinction between rel- 
atively benign vs. catastrophic failure modes, and because of the existence of an 
abort system. 

These distinctions mandate that safety consider the additional probability of the 
crew surviving conditioned on a mission failure. This latter conditional probability 
depends on the severity of the initiating mission loss accident and the robustness 
of the abort system. A good example would be Apollo 13. The mission failed in such 
a severe way that not only was the Command and Service Module disabled, but all 
the services in the service module were destroyed. This implied that the abort sys- 
tem, the Lunar Module, had to be robust enough not only to perform the electric 
power functions of the CSM, but also to provide all the other life sustaining func- 
tions until the Command Module could be employed for re-entry. A less severe acci- 
dent, say a benign engine failure of the Service Module engine, would have not re- 
quired the additional risk of conversion of the CO 2 extraction system for example. 
The point is that the abort system must be robust enough to address the full spec- 
trum of post accident conditions and allow the crew to survive them. So the condi- 
tional probability of an effective abort given a LOM event is an important distinc- 
tion between reliability and safety. 

Q3. How does one calculate meaningful safety characteristics such as loss of crew 
for vehicles that have not yet entered the hardware phase? 

A3. Crew safety can never be guaranteed even with a vehicle that has been built 
and has had a significant record of mission success. However this does not mean 
that designs that include certain features are not more likely to produce a safer de- 
sign than those that are not. In particular in my testimony I provided four rules 
that I believe would enhance the safety of a new launcher: 

1. Make it as inherently safe as possible. That is, make it reliable AND select 
a design with benign failure modes. 

2. Separate the crew from the likely source of failure. That is, put them on top 
of the stack where “God meant them to be”. 

3. Establish credible abort triggers balancing warning time with the threat of 
false positives. 

4. Include an abort system tested and verified for robustness for safe escape 
and recovery. 
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To calculate meaningful safety characteristics for vehicles that have not entered 
the hardware phase one uses historical operational data from heritage systems to 
establish a “surrogate” model of the new design to estimate the inherent safety, that 
is mission reliability, and the spectrum and post incident environments likely for 
credible mission loss events. A surrogate is constructed for a new launcher much 
in the same way that an opening price is established for a new initial product offer- 
ing in the marketplace. That is, in the case of an IPO the analyst looks at 
comparables that are in the market, their product lines, and their associated market 
prices, and constructs a “shadow price”, by reflecting the product line of 
comparables onto the product line of the IPO and adjusting for competitive distinc- 
tions. This shadow price becomes the opening market price. In the case of a safety 
surrogate, the analyst reviews all type comparables, in this case launchers, their 
historical heritage launch reliabilities and risk driving features, and constructs a 
“shadow risk” reflecting these features and associated risks onto the features in the 
new launcher adjusting for differences that make a difference in the risk driving ele- 
ments of the new launcher design. 

Once the surrogate is established each of the credible incident environments are 
simulated to determine the physical impact of the radiative, impulse pressure wave, 
and fragmentation environments on the crew safe abort given the stack geometry, 
launch abort system design and crew module fragilities, throughout the ascent tra- 
jectory. The combination of the geometry, post accident insult environment and the 
fragilities of the crew module forecast the overall abort effectiveness of the configu- 
ration given the inherent reliability of the launcher once deployed. 

This approach is distinguished from the more traditional launch reliability ap- 
proach used in the past by its reliance on historical data, the establishment of a 
vehicle surrogate from the top down, that is on a functional not component basis, 
so as to capture the primary causes of historical failures, and the use of first prin- 
ciples physics codes to establish the post accident environments and the cor- 
responding abort effectiveness. 

It is believed that employing such an approach provides estimates of loss of crew 
probabilities, within reasonable uncertainty bounds, so as to allow for discrimination 
of the crew safety potential among proposed designs. 

Q4. What are the key determinants in designing an effective abort and escape sys- 
tem? What compromises should be avoided? 

A4. The most important determinants in designing an abort system are the bal- 
ancing of escape acceleration and acceptable g load on the crew so as to provide for 
maximum separation distance from the approaching hazards without endangering 
the crew further during the abort and the avoidance of false positives that would 
cause aborts from an acceptable system. What should be avoided is to use the abort 
system as a crutch against unacceptable inherent safety for example, by claiming 
indefensibly high levels of abort effectiveness. 

Q5. What safety considerations should guide the Congress’ evaluation of the implica- 
tions of NASA relying solely on commercially provided crew transport and ISS 
crew rescue services? 

A5. As was mentioned, even a significant record of mission success is not enough 
to ensure safety at dramatically higher levels than those currently provided by the 
shuttle. Congress should require that NASA become involved in a wholesale evalua- 
tion of the design features of each proposed design including that of the crew mod- 
ule. and the launch abort system. This evaluation should include the heritage of 
those features in terms of their historic performance especially as it relates to the 
post incident conditions that would be imposed on the crew. Congress should require 
that NASA impose strict first principles physics based simulations to establish a 
credible estimate of the abort effectiveness to be applied to the integrated crew 
launch stack, including the launcher, the launch abort system, and the crew module. 
Congress should also require that NASA establish resident inspectors at the produc- 
tion facilities of all the major manufacturers of the launch, crew module, and launch 
abort system. It also should require process control and inspection during manufac- 
turing and testing, and the identification and close out of anomalies including de- 
sign and or process changes implemented and their effectiveness. Finally Congress 
should require that NASA impose a strict and challenging ground and flight test 
program for the proposed launch abort system, including a full up flight test of the 
system to ensure its robustness. 

Q6. The Augustine Committee’s report mentioned that a leading objective of the 
ESAS effort was to minimize the gap between the last shuttle flight and that 
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of the new vehicle. You were a member of the study. Were there any other major 
objectives? 

A6. Yes there were. The most important major objective, and the one that I was 
most intimately involved in, was to ensure that the CAIB recommendation that the 
replacement crew launcher for the shuttle would be an order of magnitude safer 
than the shuttle. Other major objectives were to fit into the funding profile, to allow 
for payload performance objectives to be met, and to ensure that the architecture 
chosen was capable of enabling a path forward to a crewed lunar and eventually 
a crewed Mars mission. 

Q7. How meaningful are the distinctions between the Loss of Crew figures for dif- 
ferent options contained in the Exploration Systems Architecture Study (ESAS)? 

A7. The ESAS, as its name implies, was directed at the selection of an architecture 
to enable exploration beyond low earth orbit. The focus was therefore on discrimi- 
nating among the suggested alternative architectures, and associated elements, so 
that the most effective one would be selected to be carried forward. In this regard 
the Loss of Crew estimates made at the time of ESAS were directed at highlighting 
differences that made a difference among the alternatives. The estimates were not 
intended to represent the absolute Loss of Crew risk of any of the alternatives but 
rather to distinguish among them. In particular, estimates of the abort effectiveness 
of the various alternatives were based upon rough estimates of the post accident 
physics, and not on the more detailed first principles physics code results subse- 
quently obtained for the Ares I vehicle as it has progressed through development. 

Q8. Having been on the ESAS effort, you have a unique perspective on what would 
be needed to replicate similar analyses of alternatives your team did not con- 
sider. If NASA was to be directed to perform a similar safety analysis on an- 
other alternative, what is the rough estimate of the cost and time it would take 
to perform the physics based analysis that was done for the recommended 
launch alternatives — those that resulted in Ares I and Ares V. 

A8. First I have to correct two impressions that seem to be included in the question 
that are not precisely correct. The ESAS team considered many of the alternatives 
that have been subsequently suggested including the shuttle side-mount, and the 
EELV alternatives of the Atlas V and Delta IV families, we just did not consider 
them in the detail that we subsequently did for the selected Ares I alternative. Also, 
we did not, at least at the last of my involvement, consider the detailed physics 
analysis that we had performed on Ares I on the Ares V vehicle because subsequent 
to ESAS we were not considering it as a potential crew launcher. 

The performance of a similar analysis to another alternative would depend on how 
much of the work we have done so far could be used and how readily available finite 
element models of the alternative would be. The physics work would have to be done 
on a massively parallel computational system such as the Pleiades project at the 
NASA Advanced Supercomputing (NAS) Division at Ames. This Supercomputer is 
dedicated to the Exploration program so a cost is not available. We do know that 
it took 5 million hours of equivalent CPU time for the Ares I analysis. These esti- 
mates assume the availability of a basic understanding of the aerodynamics, trajec- 
tory information of any of the alternate vehicles, which are generated as a matter 
of course in the design process by the aero analysis teams at MSEC and ARC. That 
is, this information would have to be generated in order to perform a meaningful 
evaluation of abort effectiveness. NASA JSC has already completed some explor- 
atory work on the side-mount. If this work not sufficient additional exploratory CFD 
would have to be performed whereas existing Orion abort trajectory/aerodynamic in- 
formation for Ares I could be used to arrive at a first order approximation for other 
in-line concepts. 

The calendar time estimated for the side-mount would be 6 months if extra work 
were required and 4 months for each of the other concepts. The labor costs would 
vary depending on the concept, but a rough estimate of the cost would be between 
$250-350K per concept. However the actual cost would have to be negotiated be- 
tween NASA Ames and its chosen contractor and work could be done in parallel if 
multiple concepts are to be considered. 

Q9. In your opinion, what would be required in practice to implement the Augustine 
Committee’s suggestion that NASA exercise a strong oversight role in assuring 
commercial vehicle safety? 

A9. To a degree this question has already been answered in the answer to question 
5, but a summary of what would have to be done is mentioned here. Firstly NASA 
would have to appoint a team of people to sit down with the proposed commercial 
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supplier and learn the launch vehicle from top to bottom. Then the team would have 
to develop an understanding of the relationship of the various systems and compo- 
nents implementing the various critical functions on the proposed launcher and that 
of the historical heritage of launchers. The NASA team would then have to develop 
a surrogate of the proposed launcher by relating its critical functional implementa- 
tion and associated failure modes to the historical heritage data set. The former 
analysis would attempt to establish the mission reliability of the proposed launcher 
in a crew application. (Note: This would be different from the launcher mission reli- 
ability in a payload application due the integration impact of the crew module and 
support systems module and the launch abort systems and due to modifications of 
the launcher systems, such as the addition of red lines on the engines and abort 
triggers on the vehicle.) The latter would establish the post accident conditions that 
would need to be modeled using the first principles physics simulations to establish 
the abort effectiveness. 

Then, if the launcher is seen to have met the minimum conditions for consider- 
ation as a crew launcher, NASA would have to establish an on site inspection team 
at the facility of the manufacturer of all the major elements of the design. The con- 
tractor would be required to involve NASA in all the major tests performed on the 
vehicle and the associate launch abort system and crew module and its support sys- 
tems module, review all anomalies and work with the contractor to close them out 
by design or manufacturing process changes. In short NASA would have to perform 
the same investigation it has had to perform on the Russian Soyuz, plus the addi- 
tional manufacturing and process inspection that it has been unable to conduct on 
Soyuz in order to ensure that the launcher has been developed as an equivalent to 
a NASA developed vehicle. 

Questions submitted by Representative Pete Olson 

Ql. Part of NASA’s rationale for selecting a solid rocket motor for the first stage of 
the Ares 1 is that it is inherently a simpler design with few moving parts. But 
other U.S. systems using liquid propulsion have been highly reliable as well. 
Taking into account their entire lifecycle, can you comment on the overall safety 
records of solids vs. liquid rocket motors and whether this should be a factor 
in the overall architecture^ If a proposed commercial crew system relies on liq- 
uid boosters, or a combination of liquid and solid, how does that affect the Loss 
of Crew calculations. 

Al. There is no doubt that liquid propulsion systems, especially those that have 
been proposed prior to the Ares I, have been shown to be highly reliable. In fact 
the work performed prior to and during the ESAS study indicated that a single core 
liquid would be an equivalent approach with the Atlas V being slightly preferred 
to the Delta IV from a safety perspective. The problem was that the payload of these 
vehicles was so limited that it was considered unacceptable as a crew replacement 
for the shuttle for either the lunar or ISS mission. The only single core alternative 
that had the thrust, capable of carrying the required payload was the 2.5 million 
pound thrust shuttle solid, (now about 3.0 million pounds with the 5th segment 
added). To compete with this capability the heavy EELV alternatives versions had 
to be considered and it is the addition of the two strap-on liquid core boosters that 
made the alternatives significantly more risky than the single core solid. In addition 
to the simple multiplication of engines and propulsion systems, which have been 
shown historically to be launch vehicle risk drivers, there were the additional fuel 
load and the potential for thrust imbalance problems. In addition, for the Delta IV 
heavy, the only heavy currently in operation, has flame pit H2 burn-off problems 
at liftoff. All of these contribute to the post accident risk consequences. It is the 
combination of the increased mission risk of the triple core heavy lift launcher and 
the post accident abort environment that causes the EELV alternatives to be fore- 
casted to have almost three times the launch risk of the Ares I as I mentioned in 
my testimony. 

So if a single core liquid booster would be able to lift the required six passenger 
Orion to the ISS, especially if it were the Atlas V, it would be a competitor to the 
Ares I, but we would have to fly at least two, and possibly three Atlas Vs to meet 
the payload requirement. Even though the Atlas V might expose the crew to an indi- 
vidual launch risk equal to that of the Ares I, the cumulative risk of multiple 
launches would again be significantly higher than a single Ares I launch even with- 
out considering the benign failure impact of the dominant solid booster failure 
modes. Therefore if crew safety is to be a significant discriminator among alter- 
natives then it should be a factor in the overall architecture, and if it is the sine 
qua non as the Augustine report indicates then it should be the most critical factor. 
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Strap-on boosters in general represent a more difficult environment for crew es- 
cape in event of a launch catastrophe because they increase the probability of in- 
volvement of greater amounts of fuel in the post accident environment. This is true 
for both liquid and solid tandem or barreled boosters. However since liquid engines 
can be monitored and shut-down and since a significant portion of a liquid booster 
risk is in benign shutdown the impact on Loss of Crew risk is not as severe as with 
solids. When solids are used as either strap-ons (either tandem or barreled) to the 
central core booster the predominant historical failure modes of the solid, case 
breach or soft-goods (as in the case of the Challenger accident) or nozzle burn 
through, interact with the liquid core if the hot gas jet impinges upon the core as 
in the case of Challenger and the Delta II and Titan 34D accidents. The probability 
of this occurring is higher with a barreled solid because of its closer proximity to 
other solids and the liquid core so the solid angle of impingement is greater. How- 
ever with tandem boosters there is the additional problem of thrust imbalance. That 
is the imbalanced thrust from one side to the other of the stack can cause significant 
abnormal additional loads on the stack that can cause aerodynamic breakup even 
if the hot gas plume does not impinge on the central core. This is particularly a 
problem when the tandem solid boosters are large and represent a major portion 
of that boost thrust as is the case for the shuttle and the Titan 34D. In fact post 
flight analysis of the Challenger accident indicated that the thrust imbalance was 
such that aerodynamic breakup would have probably occurred without impinge- 
ment. 

This post-accident interaction effect was known well before ESAS and was docu- 
mented as part of the previous OSP investigations contained in the Bullman Report 
that I am unable to attach because of ITAR restrictions, but which has been sup- 
plied to the Subcommittee staff. In fact the Bullman participants were so aware of 
this fact that they recommended that solids not be used in a configuration of any 
future crewed vehicle. Specifically they recommended: 

R8.2-2 Unless the Program is able to generate new data that demonstrates that 
SRM explosions are “abortable,” the program should not plan to use ELV configura- 
tions with strap-on SRMs for crewed flights of the spacecraft. In addition to the 
stack explosion issue, the inability to terminate SRM thrust and its affects on sepa- 
ration profile must be assessed. Refer to the report reliability discussion for a quan- 
titative discussion. 

Thus, in answer to the second part of the question, yes the post accident impact 
of strap-on boosters would be felt for all cases and this is one of the reasons why, 
independent of the increased risk of additional hardware, a single core booster, ei- 
ther solid or liquid, is to be preferred to any configuration that would use strap- 
ons. Now the degree to which the incorporation of strap on boosters impacts the 
Loss of Crew risk depends on the type of strap-on and the overall configuration. In 
general liquid strap-ons have less of an impact than solids, and configurations with 
the crew on top have less of an impact than side-mount configurations. This can be 
seen in the comparative analysis chart given in my testimony where the liquid strap 
on configurations are slightly less risky than the solids, and the in-line Ares V 
crewed configuration is less risky than the shuttle derived side-mount. This figure 
can be used to grossly estimate the relative risk of the various strap-on configura- 
tions and explains why any of them, solid or liquid, in line or side-mount, would 
be expected to be more risky than the single core solid Ares I configuration. How- 
ever, to understand the specifics and absolute values of the relative risks of the var- 
ious configurations would require detailed post accident physical simulations similar 
to those already performed on the Ares I configuration. 


Questions submitted by Representative Dana Rohrabacher 

Ql. During the Q&A period, you seem to be explaining that in order to get the per- 
formance necessary to loft a crew capsule on an Atlas-class vehicle would require 
an Atlas 431 (or equivalent) with three strap-on boosters. Would you please ex- 
plain the design and safety considerations associated with crew escape using ex- 
isting or modified EELVs? 

Al. The safest configurations, whether solid or liquid, are single core vehicles. This 
is not only because of the simpler design but also because of the limited fuel load 
and the elimination of potential interaction impacts subsequent to mission failure 
all of which increase the hazard potential of the post failure environment that the 
abort system must negotiate. 

So if a single core liquid booster would be able to lift the required six passenger 
payload to the ISS, especially if it were the Atlas V, it would be a competitor to 
the Ares I, but we would have to fly at least two, and possibly three Atlas Vs to 
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meet the payload requirement. Even though the Atlas V might expose the crew to 
an individual launch risk equal to that of the Ares I, the cumulative risk of multiple 
launches would again be significantly higher than a single Ares I launch even with- 
out considering the benign failure impact of the dominant solid booster failure 
modes. 

Strap-on boosters in general represent a more difficult environment for crew es- 
cape in event of a launch catastrophe because they increase the probability of in- 
volvement of greater amounts of fuel in the post accident environment. This is true 
for both liquid and solid tandem or barreled boosters. However since liquid engines 
can be monitored and shut-down and since a significant portion of a liquid booster 
risk is in benign shutdown the impact on Loss of Crew risk is not as severe as with 
solids. When solids are used as either strap-ons (either tandem or barreled) to the 
central core booster the predominant historical failure modes of the solid, case 
breach or soft-goods (as in the case of the Challenger accident) or nozzle burn 
through, interact with the liquid core if the hot gas jet impinges upon the core as 
in the case of Challenger and the Delta II and Titan 34D accidents. The probability 
of this occurring is higher with a barreled solid because of its closer proximity to 
other solids and the liquid core so the solid angle of impingement is greater. How- 
ever with tandem boosters there is the additional problem of thrust imbalance. That 
is the imbalanced thrust from one side to the other of the stack can cause significant 
abnormal additional loads on the stack that can cause aerodynamic breakup even 
if the hot gas plume does not impinge on the central core. This is particularly a 
problem when the tandem solid boosters are large and represent a major portion 
of that boost thrust as is the case for the shuttle and the Titan 34D. In fact post 
flight analysis of the Challenger accident indicated that the thrust imbalance was 
such that aerodynamic breakup would have probably occurred without impinge- 
ment. 

This post-accident interaction effect was known well before ESAS and was docu- 
mented as part of the previous OSP investigations contained in the Bullman Report 
that I am unable to attach because of ITAR restrictions, but which has been sup- 
plied to the Subcommittee staff. In fact the Bullman participants were so aware of 
this fact that they recommended that solids not be used in a configuration of any 
future crewed vehicle. Specifically they recommended: 

R8.2-2 Unless the Program is able to generate new data that demonstrates that 
SRM explosions are “abortable,” the program should not plan to use ELV configura- 
tions with strap-on SRMs for crewed flights of the spacecraft. In addition to the 
stack explosion issue, the inability to terminate SRM thrust and its affects on sepa- 
ration profile must be assessed. Refer to the report reliability discussion for a quan- 
titative discussion. 

Thus, in answer to the second part of the question independent of the increased 
risk of additional hardware, a single core booster, either solid or liquid, is to be pre- 
ferred to any configuration that would use strap-ons because it presents a less haz- 
ardous post mission failure escape environment. Now the degree to which the incor- 
poration of strap on boosters impacts the Loss of Crew risk depends on the type of 
strap-on and the overall configuration. In general liquid strap-ons have less of an 
impact than solids, and configurations with the crew on top have less of an impact 
than side-mount configurations. This can be seen in the comparative analysis chart 
given in my testimony where the liquid strap-on configurations are slightly less 
risky than the solids, and the in-line Ares V crewed configuration is less risky than 
the shuttle derived side-mount. This figure can be used to grossly estimate the rel- 
ative risk of the various strap-on configurations and explains why any of them, solid 
or liquid, in line or side-mount, would be expected to be more risky than the single 
core solid Ares I configuration. However, to understand the specifics and absolute 
values of the relative risks of the various configurations would require detailed post 
accident physical simulations similar to those already performed on the Ares I con- 
figuration. 
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Answers to Post-Hearing Questions 
Responses by Lt. Gen. (Ret.) Thomas Stafford, United States Air Force 

Questions submitted by Chairwoman Gabrielle Giffords 

Ql. As you know, the Augustine Committee projected that commercial crew transpor- 
tation could be available by 2016. R does not appear that this projection re- 
flected the time needed for all of the milestones that must be met prior to the 
point at which NASA would be able to use such services to fly its astronauts 
to the ISS such as the time needed to get Congressional authorization and ap- 
propriation of funds; agreement on human-rating and other safety standards 
and means for verifying compliance; development of a regime for certification; 
and contract competition, negotiation and award of contract(s), and potential 
protest(s) by losing bidder(s). There are no small tasks, and it is not obvious that 
any of them could be skipped if the government is to make use of those services. 

• In your opinion, what are currently the largest technical challenges or hurdles 
that potential commercial crew transportation providers are facing that might 
cause delays to their projected initial operating dates? 

• How confident can the Congress be that a commercial crew capability can be 
operational in 2016 while still having to carry out all of the activities that 
need to be completed before the first NASA astronaut can safely ride on an 
operational vehicle to the International Space Station. 

Q2. What was the extent of the testing and analyses performed on the Gemini space- 
craft and Titan launch vehicle before NASA was comfortable with system’s safe- 
ty? How “simple” was it to build safety into Gemini. 

Q3. I understand that training for off-nominal operations is an important facet of 
crew training. Astronauts are acquainted with how to identify these off-nominal 
operations and apply ways to respond to them. During your illustrious career 
in human space flight, how important was training for off-nominal operations 
to enhance safety? What level of training would need to be performed to fly 
NASA astronauts on commercial transportation systems? 

Q4. Do you have any concerns regarding the option of canceling Ares I to go to the 
ISS and relying on a new set of would-be commercial providers? Is there a risk 
of being in a situation where those emerging enterprises are deemed “too impor- 
tant to fail” and we end up having to support them at whatever cost and time 
it takes? 

Al, A2, A3, A4. Chairwoman Giffords — With respect to your first question, I agree 
that the projections from the Augustine Committee did not reflect the time needed 
for milestones and issues that must he met for a certified rocket and a certified 
spacecraft before NASA astronauts would he launched to the International Space 
Station. As described in my testimony a human-rate launch vehicle and spacecraft 
must start from the first time drawings are put together. All of the issues you out- 
lined can add a considerable length of time to the process. I have great confidence 
that to “really certify human-rated spacecraft with a launch vehicle will not be 
ready any sooner by any proposed commercial vehicles than those by NASA.” Ares 
I Orion would have flown in 2013, but funds were taken to fly the Space Shuttle 
and complete the ISS due to the 0MB not allowing NASA to request the adequate 
funding. As I outlined in my testimony, I doubt that the President was aware of 
the gap that 0MB was causing in the schedule by not allowing NASA to request 
adequate funding and would require our crews and international partner crews to 
pay to fly on Russian launch vehicles and spacecrafts. I agree that this is no small 
task and do not see any items skipped if the government uses a commercial pro- 
vider. 

My opinion is that there are large technical challenges for potential commercial 
crew provided rockets and spacecrafts to meet the NASA Office of Safety and Mis- 
sion Assurance requirements to meet initial operational dates. In response to your 
second point, as I expressed, due to experience in the Gemini and Apollo, I flew on 
three different types of vehicles and four different types of spacecraft and I do not 
feel that Congress can be confident that a commercial crew vehicle will be oper- 
ational in 2016 and carry out all of the activities to be completed before a NASA 
crew is launched. 

With regard to your second question, NASA required 39 months of testing and 
analysis on the Titan II launch vehicle and similar time on the Gemini spacecraft 
prior to the first launch. The major Titan II components, tanks, and structures for 
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the Gemini spacecraft were built at the Martin Denver plant then shipped to a sepa- 
rate controlled assembly line at Martin’s Baltimore plant. Here modifications were 
made to the booster and a series of safety modifications, including the Emergency 
Detection System, were installed on the booster. Most people today do not realize 
that there was a completely separate assembly line for the Gemini Titan II launch 
vehicle. The first and second stage Aerojet engines powered the Titan and were built 
in Sacramento under the special quality conditions; then shipped with an escort to 
the Martin plant where they were installed on the vehicle. These escorts stayed 
with the engines all the way through to Launch Pad 19 until launch. 

With regard to your third question, to the four prime missions that I flew and 
three back-up crew missions that I was a member of, we literally spent hundreds 
of hours in the factory for each mission. We also spent hundreds of hours in the 
spacecraft processing, testing, and checkout before launch. For simulations we 
worked hundreds of hours and ran all of the nominal and off nominal operations 
and all emergency situations. Many of the simulations were integrated with the 
Mission Control Center. The level of training needed to fly astronauts on commer- 
cial transport systems should be no less than our previous experience. 

With regard to your fourth question, I do not have concerns that Ares I, which 
has been designed from every piece part up onward to meet the NASA Mission and 
Safety Assurance and human rated factors similar to what we did on the Apollo pro- 
gram. With commercial providers, I know that none will start from the beginning 
design of the launch vehicle for human rated requirements. As I pointed out, the 
Gemini Titan Program was a high risk demonstration program. We knew that cer- 
tain areas of launch from the time of ignition throughout the launch profile and into 
orbit, would be hazardous if not fatal, if failure occurred. 

With respect to the latter part of your fourth question, “Is there a risk of being 
in a situation where those emerging enterprises are deemed ‘too important to fail’ 
and we end up having to support them at whatever cost and time it takes”, the an- 
swer is emphatically yes. Once the program starts and encounters major technical 
and cost difficulties it is very difficult to stop unless the program is cancelled. 


Questions submitted by Representative Pete Olson 

Ql. In your testimony you spoke briefly about the relationship between the President, 
the 0MB, and the Congress in setting and carrying out our space programs. 
Would you please elaborate on what you see as the strengths, weaknesses, and 
potential problems impacting our nation’s ability to carry out effective space 
policies^ 

Al. Ranking Member Olson — In answer to your question in relation to the Presi- 
dent, 0MB, and Congress in a setting to carry out the US Space program, the polit- 
ical forces have been very visible in the last 18 years vs. what is experienced from 
the start of the human space flight program. In the many times that I have testified 
in front of Congressional bodies (Senate and House), the most important issue I 
have emphasized is that we need is a long range strategic plan that the country 
can follow with only slight modifications. This fact was brought out vividly by the 
Columbia Accident Investigation Board. 

My first recommendation to the Augustine Committee was to reestablish the Na- 
tional Space Council since it was written into law with the efforts of Senate Major- 
ity Leader, Lyndon Johnson, in 1958. Under this law, the President can enact the 
council and it worked extremely well during the Mercury, Gemini, and Apollo pro- 
grams. It was also effective for four years under President George W. H. Bush. 
Without a strategic oversight group such as the National Space Council, you will 
have second level tier individuals like those in the 0MB who makes major acts on 
programs. For example, I am sure that the President did not recognize at the time 
that an individual in 2004 told NASA that they have 15 flights to finish the Space 
Shuttle project by 2008 and this was during the time that the Space Shuttle was 
still grounded after the Columbia accident, which would result in the US buying 
launches from the Russians for many years. This is the same second tier level indi- 
vidual, at the 0MB, who arbitrarily set the date at 2015 for the termination of US 
funding of this great international multi-partner laboratory and spacecraft, the ISS. 


Questions submitted by Representative Dana Rohrabacher 

Ql. There have been suggestions that a smaller, simpler vehicle designed just to ac- 
cess low Earth orbit and the International Space Station could be developed 
faster and less expensively than Orion. Furthermore, such a vehicle might be 
more easily lofted using either existing or modified EELV’s. From your experi- 
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ence aboard the two-person Gemini spaeecraft, do you see any reason why a 
smaller version of a capsule would be any simpler or less expensive to eertify 
as human-rated? 

Al. Mr. Rohrabacher — To provide a safe launch of a spacecraft on a rocket booster 
to orbit a human crew is always a major disciplined task. Whether you go beyond 
LEO or not, the same discipline would have to be followed whether the spacecraft 
is to fly to the moon or Mars, or only operate in only LEO, would require the same 
discipline to achieve LEO and safely return. A larger more complex spacecraft natu- 
rally costs more than a smaller spacecraft. We do not need as extensive systems and 
fuel as for a Mars spacecraft would require as compared to LEO. 

My recommendation would be for the development of a crew module in a block 
series (i.e. Block I, II, III), LEO, Moon, or Mars mission. The smaller version would 
be only somewhat less expense to certify safety for a crew. 


o 



